Privilege escalation is a commonly employed attack vector in the Windows operating system environment.
Attackers often leverage offensive tools such as Meterpreter, CobaltStrike, or Potato tools to execute code such as “NT AUTHORITY\SYSTEM.”
These tools typically employ token duplication and service manipulation techniques to perform attacks like LSASS tinkering.
The Deep Instinct security research team developed an RPC mapper tool for analyzing RPC methods. The BfeRpcOpenToken method, which is part of the Windows Filtering Platform, captured their attention.
The Windows Filtering Platform is a native platform that offers network traffic control capabilities based on various attributes like application, user, address, and port.
FWPUCLNT.DLL and BFE.DLL play key roles in extracting tokens. By calling FwpsOpenToken0, a handle is duplicated from BfeRpcOpenToken, effectively accessing the BFE service token.
BfeDriverTokenQuery triggers BfeRpcOpenToken, leading to a device IO request to “WfpAle.”
This device was created by the tcpip.sys driver becomes instrumental in the token extraction process.
Token query involves calculating a hash based on the LUID, iterating over a hash table, and identifying the appropriate entry. The token insertion function, WfpAleInsertTokenInformationByUserTokenIdIfNeeded, is explored, revealing its relation to IPSec.
Duplicating Tokens via WFP:
By sending a device IO request, WfpAleProcessTokenReference is invoked, attaching the thread to the process space, duplicating tokens, and adding them to the hash table. Brute-forcing the LUID can lead to token duplication.
Triggering IPSec Connection
Configuring an IPSec policy can lead to token insertion into the hash table. The Print Spooler service is exploited to achieve this through RPC calls.
Gaining the token of another logged-on user can facilitate lateral movement.
The OneSyncSvc service, involving RPC calls and ALPC ports, is manipulated to achieve this. While these attack techniques are designed to be stealthy, they are not undetectable.
The “NoFilter” technique highlights a sophisticated and covert approach to privilege escalation by exploiting the Windows Filtering Platform.
Security professionals are advised to stay vigilant, monitor for suspicious activities related to the Windows Filtering Platform, and explore ways to defend against such attacks.
Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.
Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search…
Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the…
Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains, posing…
Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware,…
The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of…
Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…