BYOVDLL – A New Exploit That Is Bypassing LSASS Protection

In July 2022, Microsoft patched a well-known PPL bypass flaw, initially discovered by Ionescu and Forshaw. 

This allowed protection circumvention without kernel code execution, and this update now broke the PPLdump PoC.

SCRT Team researchers at Orange Cyberdefense recently discovered a new exploit that enables threat actors to bypass LSASS protection. This new exploit was dubbed “BYOVDLL” (Bring Your Own Vulnerable DLL).

Technical Analysis

However, in October 2022 Gabriel Landau disclosed that the vulnerability remained un-patched through “Bring Your Own Vulnerable DLL” approach and successfully ran PPLdump without any necessary tweaks.

Free Webinar on Detecting & Blocking Supply Chain Attack -> Book your Spot

This demonstration triggered interest in looking into arbitrary code execution in protected processes by different DLLs, especially not requiring system reboots against Microsoft’s attempted patching efforts.

PPLdump BYOVDLL (Source – SCRT)

Two tiers of Windows system protection, namely Protected Process (PP) and Protected Process Light (PPL), exist with different signers defining a grading or ranking of security.

LSASS, which is a PPL, proves to be a primary focus for in-memory credential extraction since it has a wider attack surface compared to the other high-level PPs.

KeyIso service within LSASS had two serious vulnerabilities:-

Exploiting these required loading vulnerable versions of both keyiso.dll and ncryptprov.dll into LSASS.

This was done through several steps such as changing registry settings to load a vulnerability keyiso.dll, extracting and properly signing the DLL, and then registering a custom Key Storage Provider to load a vulnerable ncryptprov.dll.

Notably, this exploit method bypassed Windows’ security measures without requiring rebooting the system, showing how sensitive the present balance is between making your systems secure while still having exploitable areas.

The successful execution of this exploit highlights persistent difficulties in defending critical system processes against sophisticated attack vectors like those targeting credential theft from seemingly protected processes.

Within the protected LSASS process, the exploit chain was tested successfully by employing vulnerable versions of keyiso.dll and ncryptprov.dll.

To circumvent PPL restrictions, which prevent loading unsigned DLLs, the original LoadLibraryW call was replaced with OutputDebugStringW. 

This change meant instead of relying on Process Monitor to detect filesystem events there could be an execution confirmation through DebugView.

Executing OutputDebugStringW from within LSASS (Source – SCRT)

The steps in exploiting involved restarting KeyIso service and registering a custom Key Storage Provider.

After executing the proof-of-concept code, the debug message “I’m in LSASS!!!” confirmed successful arbitrary code execution in this secure environment.

From BYOVDLL to arbitrary code execution within a protected LSASS process (Source – SCRT)

This demonstration proved that bringing your own vulnerable dll is a valid technique for re-introducing and exploiting patches against high-security vulnerabilities (CVE-2023-36906 and CVE-2023-28229).

Though only displaying a debug message, it also laid the foundation for more sophisticated exploitation techniques within secured processes.

Are you from SOC and DFIR Teams? Analyse Malware Incidents & get live Access with ANY.RUN -> Get 14 Days Free Acces

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Node.js systeminformation Package Vulnerability Exposes Millions of Systems to RCE Attacks

A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions…

20 hours ago

Skuld Malware Using Weaponized Windows Utilities Packages To Deliver Malware

Researchers discovered a malware campaign targeting the npm ecosystem, distributing the Skuld info stealer through…

2 days ago

BellaCiao, A new .NET Malware With Advanced Sophisticated Techniques

An investigation revealed an intrusion in Asia involving the BellaCiao .NET malware, as the initial…

2 days ago

Malicious Apps On Amazon Appstore Records Screen And Interecpt OTP Verifications

A seemingly benign health app, "BMI CalculationVsn," was found on the Amazon App Store, which…

2 days ago

Lazarus Hackers Using New VNC Based Malware To Attack Organizations Worldwide

The Lazarus Group has recently employed a sophisticated attack, dubbed "Operation DreamJob," to target employees…

2 days ago

New Python NodeStealer Attacking Facebook Business To Steal Login Credentials

NodeStealer, initially a JavaScript-based malware, has evolved into a more sophisticated Python-based threat that targets…

2 days ago