Anti Virus Software’s Design Flaw Leads to Bypass Windows Local Privilege

A new Antivirus design flaw has discovered and named as AVGater for the Windows Local Privilege Escalation Vulnerability which is presented in many antiviruses that can be abused and bypassed using restore from quarantine Method.

Quarantine is a special storage suspicious (probably infected) objects used by Antivirus engine. A function of antivirus software that isolates infected files on a computer’s hard disk. Files put in quarantine by antivirus engines are no longer capable of infecting their hosting system.

Also Read:  Windows Defender Antivirus Bypass Allows Any Malware to Execute on a Windows Machine

This restoring file from an antivirus future called quarantine leads to exploited by any local user and escalate the Windows Local Privilege to gain full control over the endpoint.

An Antivirus Working Point of view, it has categorized with 3 type of privileges which has its own functionality in terms of Windows access with user mode and kernel mode

1. First one is a user interface that can be accessed by unprivileged users to the functions such as virus warning, settings, system states etc that will be working with user mode.
2. The second one is Windows Services that will be used by Antivirus for monitoring file access, Virus Quarantine and updating with same user mode.
3. The third one is kernel component that is used to perform some core functions such as scanning, Remediation, Rootkit Detection Etc.

So what Next with AVGater to Escalate Windows Local Privilege

In this case, unprivileged users don’t have much power to performing more accessible and they only have the option to working with the user interface. but windows services have some more ability to do than unprivileged users.Kernal component, as usual, has the superpower to do everything.

Here AVGater will manipulate the Restoring Process from antivirus quarantine to any arbitrary filesystem location.

According to Researcher, In This case, restore process is most often carried out by the privileged AV Windows user mode service. 

Hence, file system ACLs can be circumvented (as they don’t really count for the SYSTEM user). This type of issue is called a privileged file write vulnerability and can be used to place a malicious DLL anywhere on the system.

This will be achieved by Tempering the NTFS directory junctions and Restore process will be successfully Executed.

A command line interface called Mklink will help to create symbolic links for directories that can be created by anyone.

So once Malicious File moved to quarantine location by Antivirus engine, an unprivileged user can restoring the previously quarantined file to any other destination we want.

” Basic DLL Working order, By restoring the previously quarantined file, the SYSTEM permissions of the AV Windows user mode service are misused, and the malicious library is placed in a folder where the currently signed in user is unable to write to under normal conditions.”

A non-admin user would not be able to copy files inside this folder, but antivirus programs work under SYSTEM privileges, which means the file restored from quarantine will be sent to that folder without triggering errors or alerts.

Finally, it will be loaded into privileged windows process and malicious code will be again back to normal Location and local non-admin attacker gained full control over the affected endpoint. Researcher said.

We do have Proof of concepts for this Local privilege escalation flaw for Antivirus Vendors. POC was Successfully tested against Emsisoft Anti-Malware and Malwarebytes.