Wednesday, April 24, 2024

Anti Virus Software’s Design Flaw Leads to Bypass Windows Local Privilege

A new Antivirus design flaw has discovered and named as AVGater for the Windows Local Privilege Escalation Vulnerability which is presented in many antiviruses that can be abused and bypassed using restore from quarantine Method.

Quarantine is a special storage suspicious (probably infected) objects used by Antivirus engine. A function of antivirus software that isolates infected files on a computer’s hard disk. Files put in quarantine by antivirus engines are no longer capable of infecting their hosting system.

Also Read:  Windows Defender Antivirus Bypass Allows Any Malware to Execute on a Windows Machine

This restoring file from an antivirus future called quarantine leads to exploited by any local user and escalate the Windows Local Privilege to gain full control over the endpoint.

An Antivirus Working Point of view, it has categorized with 3 type of privileges which has its own functionality in terms of Windows access with user mode and kernel mode

  1. First one is a user interface that can be accessed by unprivileged users to the functions such as virus warning, settings, system states etc that will be working with user mode.
  2. The second one is Windows Services that will be used by Antivirus for monitoring file access, Virus Quarantine and updating with same user mode.
  3. The third one is kernel component that is used to perform some core functions such as scanning, Remediation, Rootkit Detection Etc.

So what Next with AVGater to Escalate Windows Local Privilege

In this case, unprivileged users don’t have much power to performing more accessible and they only have the option to working with the user interface. but windows services have some more ability to do than unprivileged users.Kernal component, as usual, has the superpower to do everything.

Here AVGater will manipulate the Restoring Process from antivirus quarantine to any arbitrary filesystem location.

According to Researcher, In This case, restore process is most often carried out by the privileged AV Windows user mode service. 
Hence, file system ACLs can be circumvented (as they don’t really count for the SYSTEM user). This type of issue is called a privileged file write vulnerability and can be used to place a malicious DLL anywhere on the system.

This will be achieved by Tempering the NTFS directory junctions and Restore process will be successfully Executed.

A command line interface called Mklink will help to create symbolic links for directories that can be created by anyone.

So once Malicious File moved to quarantine location by Antivirus engine, an unprivileged user can restoring the previously quarantined file to any other destination we want.

” Basic DLL Working order, By restoring the previously quarantined file, the SYSTEM permissions of the AV Windows user mode service are misused, and the malicious library is placed in a folder where the currently signed in user is unable to write to under normal conditions.”

A non-admin user would not be able to copy files inside this folder, but antivirus programs work under SYSTEM privileges, which means the file restored from quarantine will be sent to that folder without triggering errors or alerts.

Finally, it will be loaded into privileged windows process and malicious code will be again back to normal Location and local non-admin attacker gained full control over the affected endpoint. Researcher said.

We do have Proof of concepts for this Local privilege escalation flaw for Antivirus Vendors. POC was Successfully tested against Emsisoft Anti-Malware and Malwarebytes.


Latest articles

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...

Rewards Up to $10 Million for Information on Iranian Hackers

The United States Justice Department has announced big rewards for information leading to the...

PoC Exploit Released For Critical Oracle VirtualBox Vulnerability

Oracle Virtualbox was identified and reported as having a critical vulnerability associated with Privilege...

Tracing the Steps of Cyber Intruders: The Path of Lateral Movement

When cyber attacks strike, it's rarely a single computer that suffers. Nowadays, cybercriminals set...

U.S. to Impose Visa Restrictions on 13 Individuals Involved in Commercial Spyware Operations

To combat the misuse of commercial spyware, the United States Department of State has...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles