Friday, March 29, 2024

Anti Virus Software’s Design Flaw Leads to Bypass Windows Local Privilege

A new Antivirus design flaw has discovered and named as AVGater for the Windows Local Privilege Escalation Vulnerability which is presented in many antiviruses that can be abused and bypassed using restore from quarantine Method.

Quarantine is a special storage suspicious (probably infected) objects used by Antivirus engine. A function of antivirus software that isolates infected files on a computer’s hard disk. Files put in quarantine by antivirus engines are no longer capable of infecting their hosting system.

Also Read:  Windows Defender Antivirus Bypass Allows Any Malware to Execute on a Windows Machine

This restoring file from an antivirus future called quarantine leads to exploited by any local user and escalate the Windows Local Privilege to gain full control over the endpoint.

An Antivirus Working Point of view, it has categorized with 3 type of privileges which has its own functionality in terms of Windows access with user mode and kernel mode

  1. First one is a user interface that can be accessed by unprivileged users to the functions such as virus warning, settings, system states etc that will be working with user mode.
  2. The second one is Windows Services that will be used by Antivirus for monitoring file access, Virus Quarantine and updating with same user mode.
  3. The third one is kernel component that is used to perform some core functions such as scanning, Remediation, Rootkit Detection Etc.

So what Next with AVGater to Escalate Windows Local Privilege

In this case, unprivileged users don’t have much power to performing more accessible and they only have the option to working with the user interface. but windows services have some more ability to do than unprivileged users.Kernal component, as usual, has the superpower to do everything.

Here AVGater will manipulate the Restoring Process from antivirus quarantine to any arbitrary filesystem location.

According to Researcher, In This case, restore process is most often carried out by the privileged AV Windows user mode service. 
Hence, file system ACLs can be circumvented (as they don’t really count for the SYSTEM user). This type of issue is called a privileged file write vulnerability and can be used to place a malicious DLL anywhere on the system.

This will be achieved by Tempering the NTFS directory junctions and Restore process will be successfully Executed.

A command line interface called Mklink will help to create symbolic links for directories that can be created by anyone.

So once Malicious File moved to quarantine location by Antivirus engine, an unprivileged user can restoring the previously quarantined file to any other destination we want.

 
” Basic DLL Working order, By restoring the previously quarantined file, the SYSTEM permissions of the AV Windows user mode service are misused, and the malicious library is placed in a folder where the currently signed in user is unable to write to under normal conditions.”

A non-admin user would not be able to copy files inside this folder, but antivirus programs work under SYSTEM privileges, which means the file restored from quarantine will be sent to that folder without triggering errors or alerts.

Finally, it will be loaded into privileged windows process and malicious code will be again back to normal Location and local non-admin attacker gained full control over the affected endpoint. Researcher said.

We do have Proof of concepts for this Local privilege escalation flaw for Antivirus Vendors. POC was Successfully tested against Emsisoft Anti-Malware and Malwarebytes.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles