{
	"id": "d2c44dc8-9773-484d-9df3-4bd02f0ef179",
	"created_at": "2026-04-06T00:07:34.361068Z",
	"updated_at": "2026-04-10T03:21:11.489393Z",
	"deleted_at": null,
	"sha1_hash": "2eb528a1453015fc1761df3117aa876108cd8d20",
	"title": "Abusing Windows 10 Narrator's 'Feedback-Hub' URI for Fileless Persistence",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 751050,
	"plain_text": "Abusing Windows 10 Narrator's 'Feedback-Hub' URI for Fileless\r\nPersistence\r\nBy Giulio Comi\r\nPublished: 2019-10-19 · Archived: 2026-04-05 19:10:14 UTC\r\nNovel Accessibility Feature Abuse technique\r\nWhile investigating Ease of Access options in Windows 10 for new persistence techniques, I have actually found an\r\nundocumented one via 'Provide Narrator feedback' functionality.\r\nBehind the scenes the Narrator feedback consists in launching the custom handler via URI scheme ‘feedback-hub’.\r\nHowever, in a post exploitation scenario is possible to trivially backdoor this component with fileless payloads hosted in the\r\nregistry.\r\nEven if there is no security boundary between windows logon screen and the default user desktop (indeed both part of the\r\nsame window station WinSta0) the possibility of the interaction between the Narrator instance running in the environment of\r\nthe locked out users and the Windows logon screen opens the chance to trigger the malicious command defined in the\r\nregistry as soon as the 'Provide Narrator feedback' combination keys are pressed in the latter context.\r\nThe novel technique presented in this article has the following advantages in respect to already known Ease of Use abuses\r\n(see next paragraph):\r\nfileless (Living off the Land approach)\r\nno administrative privileges required (if physical access scenario and victim user is locked out)\r\nDemo video\r\nEtt fel inträffade.\r\nDet går inte att köra JavaScript.\r\nFor the insights, have a look at the documentation for Universal App URI schemes persistence:\r\nhttps://github.com/giuliocomi/backoori\r\nhttps://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html\r\nPage 1 of 6\n\nQuick recap of Accessibility Features for Red Teamers\r\nThe Windows Accessibility Features, a set of tools available in the Windows logon screen (like Sticky Keys),  are designed\r\nto be launched via predefined combination of keys to assist the end users. These Windows features are also quite famous\r\nbecause have been abused by APT groups for backdooring target systems in the past. Having administrative privileges is a\r\nrequirement in order to replace the genuine Windows binary of the tool ('sethc.exe' or 'narrator.exe', 'magnify.exe', etc.) with\r\nan ad-hoc binary.\r\nThis novel technique I have discovered overcomes the admin privileges condition (provided that it is physical access\r\nscenario and the victim account is locked), is fileless and currently not monitored by security detection tools.\r\nOverview of the Universal Apps URI schemes persistence\r\nThe Accessibility feature is a specific case of the more comprehensive URI persistence technique that affects all Universal\r\nApps URI, which is applicable to every URI protocol listed in the Settings under “Choose default apps by protocol”. Some\r\nof these protocols are very interesting, like ‘https’ because in this case it will be possible to trigger the payload from a\r\ncrafted web pages (with for example an \u003ca\u003e tag link) and the payload will be “MiTM” for the request by executing itself and\r\ntransparently forwarding the arguments to the legitimate default browser of the unaware victim (for more details have a look\r\nat backoori).\r\nTweaking Narrator's settings of the compromised user\r\nBut let’s not digress, the focus of this walk-through is on the Narrator feature abuse.\r\nEvery time the ‘feedback-hub’ URI is triggered via:\r\nshortcut key for Feedback Hub in the desktop environment\r\nthe task manager ‘Send feedback’ option\r\n‘explorer.exe feedback-hub:’ command\r\nNarrator Ease of Use feedback in the windows logon desktop\r\nthe defined payload will get executed.\r\nFor backdooring the last option, the one that involves the Narrator, it is recommended to apply the configuration displayed\r\nin the screenshots below. The reason is that the Narrator does not start automatically, it is very loudly and its cursor catches\r\nthe yes of the victims. Moreover, as said before the Narrator abuse works out of the box for locked out victims (therefore\r\nphysical persistence), but for signed out users it is necessary to also enable “Start Narrator before sign-in for everyone” with\r\na compromised administrative account.\r\nhttps://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html\r\nPage 2 of 6\n\nhttps://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html\r\nPage 3 of 6\n\nAnd choose a shortcut key for the ‘Provide Narrator feedback’ setting.\r\nBackdooring ‘Feedback-Hub’ URI functionality\r\n There are two approaches, the expected way is to develop a Universal App and set it as default handler and the more\r\nsmoothly one based on the editing of registry keys. Let’s focus on the second one.\r\nWe need to track down the essential keys to modify in the Registry in order to point the Feedback Hub Microsoft URI\r\nscheme to our own payload.\r\nTo have a better insights on the few steps involved, have a look at agent_plate.ps1, the agent template part of the tool created\r\nas PoC to automate this persistence technique for arbitrary specified URLs.\r\nBy looking up the registry for ‘feedback-hub’ key, we find out one registered Universal App Id:\r\nHKCR:Local\r\nSettings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\windows.protocol\\feedback-hub\r\nhttps://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html\r\nPage 4 of 6\n\nIn case the default handler was already explicitly chosen by the user it will be under key:\r\nComputer\\HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\feedback-hub\\UserChoice\r\n And then again, by looking under\r\nComputer\\HKEY_CURRENT_USER\\Software\\Classes\\Appxypsaf9f1qserqevf0sws76dx4k9a5206\r\nwe get the following configuration (by the way it is the standard one for all Universal Apps):\r\n Turned out after a not-so “educated” guess that by getting rid of the \"DelegateExecute\" entry and then adding a Powershell\r\npayload for the ‘Default’ value we will open rooms for this fileless persistence technique:\r\n The payload will be executed by pressing the ‘Provide Narrator feedback’ shortcut.\r\nhttps://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html\r\nPage 5 of 6\n\nThe feedback survey feature should not be available in the Windows logon screen, despite not being a trust boundary\r\nmisconfiguration, because it is a graphic window with a form to send. The possibility to trigger the ‘feedback-hub’ URI\r\nscheme in this context exposes Windows 10 users to an additional Accessibility Feature abuse that has the main advantage\r\nof being fileless.\r\nSource: https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html\r\nhttps://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html\r\nPage 6 of 6",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html"
	],
	"report_names": [
		"abusing-windows-10-narrators-feedback.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434054,
	"ts_updated_at": 1775791271,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2eb528a1453015fc1761df3117aa876108cd8d20.pdf",
		"text": "https://archive.orkl.eu/2eb528a1453015fc1761df3117aa876108cd8d20.txt",
		"img": "https://archive.orkl.eu/2eb528a1453015fc1761df3117aa876108cd8d20.jpg"
	}
}