Monday, November 4, 2024
HomeCVE/vulnerabilityAnti Virus Software's Design Flaw Leads to Bypass Windows Local Privilege

Anti Virus Software’s Design Flaw Leads to Bypass Windows Local Privilege

Published on

Malware protection

A new Antivirus design flaw has discovered and named as AVGater for the Windows Local Privilege Escalation Vulnerability which is presented in many antiviruses that can be abused and bypassed using restore from quarantine Method.

Quarantine is a special storage suspicious (probably infected) objects used by Antivirus engine. A function of antivirus software that isolates infected files on a computer’s hard disk. Files put in quarantine by antivirus engines are no longer capable of infecting their hosting system.

Also Read:  Windows Defender Antivirus Bypass Allows Any Malware to Execute on a Windows Machine

- Advertisement - SIEM as a Service

This restoring file from an antivirus future called quarantine leads to exploited by any local user and escalate the Windows Local Privilege to gain full control over the endpoint.

An Antivirus Working Point of view, it has categorized with 3 type of privileges which has its own functionality in terms of Windows access with user mode and kernel mode

  1. First one is a user interface that can be accessed by unprivileged users to the functions such as virus warning, settings, system states etc that will be working with user mode.
  2. The second one is Windows Services that will be used by Antivirus for monitoring file access, Virus Quarantine and updating with same user mode.
  3. The third one is kernel component that is used to perform some core functions such as scanning, Remediation, Rootkit Detection Etc.

So what Next with AVGater to Escalate Windows Local Privilege

In this case, unprivileged users don’t have much power to performing more accessible and they only have the option to working with the user interface. but windows services have some more ability to do than unprivileged users.Kernal component, as usual, has the superpower to do everything.

Here AVGater will manipulate the Restoring Process from antivirus quarantine to any arbitrary filesystem location.

According to Researcher, In This case, restore process is most often carried out by the privileged AV Windows user mode service. 
Hence, file system ACLs can be circumvented (as they don’t really count for the SYSTEM user). This type of issue is called a privileged file write vulnerability and can be used to place a malicious DLL anywhere on the system.

This will be achieved by Tempering the NTFS directory junctions and Restore process will be successfully Executed.

A command line interface called Mklink will help to create symbolic links for directories that can be created by anyone.

So once Malicious File moved to quarantine location by Antivirus engine, an unprivileged user can restoring the previously quarantined file to any other destination we want.

 
” Basic DLL Working order, By restoring the previously quarantined file, the SYSTEM permissions of the AV Windows user mode service are misused, and the malicious library is placed in a folder where the currently signed in user is unable to write to under normal conditions.”

A non-admin user would not be able to copy files inside this folder, but antivirus programs work under SYSTEM privileges, which means the file restored from quarantine will be sent to that folder without triggering errors or alerts.

Finally, it will be loaded into privileged windows process and malicious code will be again back to normal Location and local non-admin attacker gained full control over the affected endpoint. Researcher said.

We do have Proof of concepts for this Local privilege escalation flaw for Antivirus Vendors. POC was Successfully tested against Emsisoft Anti-Malware and Malwarebytes.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

A Massive Hacking Toolkit From “You Dun” Threat Group Developed To Lauch Massive Cyber Attack

The "You Dun" hacking group exploited vulnerable Zhiyuan OA software using SQL injection, leveraging...

Okta Verify Agent for Windows Flaw Let Attackers Steal User Passwords

A newly discovered vulnerability in Okta's Device Access features for Windows could allow attackers...

MediaTek High Severity Vulnerabilities Let Attackers Escalate Privileges

In its recent MediaTek Product Security Bulletin, the chipmaker disclosed two high-severity security vulnerabilities...