Zero-Day Windows Vulnerability Enables Threat Actors To Gain Admin Rights: What We Know So Far

zero-day-windows-vulnerability-enables-threat-actors-to-gain-admin-rights:-what-we-know-so-far

Did you know that camDown is easy to use, easy to maintain?

What Happened?

Security researcher Abdelhamid Naceri discovered a privilege escalation vulnerability in Microsoft Windows that can give admin rights to threat actors.

The vulnerability was discovered when Microsoft released a patch for CVE-2021-41379 (Windows Installer Elevation of Privilege Vulnerability) as a part of the November 2021 Patch Tuesday. Naceri found a bypass to the patch, as well as a more severe zero-day privilege escalation vulnerability, and published a proof-of-concept exploit for the zero-day on GitHub.

This zero-day vulnerability affects all supported client and server versions of Windows, including Windows 10, Windows 11 and Windows Server — even with the latest patches.

How Bad is This?

Pretty bad; privilege elevation is a serious situation, especially when threat actors could elevate from user to admin rights. Throughout 2021 we have seen a growing number of privilege escalation vulnerabilities land on Windows, which is only increasing the attack surface in environments at this point.

There are no workarounds currently available, according to Naceri. Due to the fact that this vulnerability and exploit leverage existing MSI functionality, it is difficult to inherently workaround.

The good news is that a threat actor would need local access to the machine to take advantage of this vulnerability. More good news is that Windows Defender detects the PoC.

What Should I Do?

Organizations that haven’t already enabled Sysmon in their environment should do so. Blumira’s newly-created PowerShell script, Poshim, streamlines Windows log collection by automatically installing and configuring NXLog and Sysmon to ship logs over Sysmon to a targeted IP.

Although there are no workarounds, admins can use an endpoint solution and a security incident and event management (SIEM) platform to detect for signs of the PoC exploit in an environment.

How To Detect

This PoC code is easily detectable in its current form due to a built-in MSI (or installer package) and the fact that the PoC has a number of hard-coded naming conventions.

Blumira security experts tested the exploit in their lab environment and found a few ways to detect the PoC:

Sysmon

With Sysmon enabled, admins can look for the following behaviors:

windows_event_id = 11
 AND target LIKE '%microsoft plz%'

By default the PoC utilizes a target with “microsoft plz” in the path, this allows for quick detection opportunities for lazy attackers.

AND

process_name = 'C:\Windows\system32\msiexec.exe'
AND target LIKE '%AppData%splwow64.exe'
AND windows_event_id in (11,26)

The second Sysmon detection uses splwow64.exe in its own AppData folder, which it creates and deletes during the process.

Windows logs

Admins can look for the following Windows logs in Event Log Viewer:

windows_log_name='Application'
AND message LIKE '%test pkg%'

Application logs that contain hardcoded test pkg similar to “microsoft plz” above. Attackers building their own exploits will not utilize this naming convention however.

AND

REGEXP_CONTAINS(message, r'Users.*AppData\Local\Temp\2\{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}}.msi')
AND user='SYSTEM
AND user_id='S-1-5-18'
AND windows_event_id=1042

The System’s Application log as system references the initial User’s appdata with the System user and SID (S-1-5-18) and user on a failed MSI install. So far in our testing we were able to reduce false positives but looking for a specific UUID4 format due to how this MSI installer activates but this may result in noise at times.

Final stage of attack shows the completion of the installer transaction as SYSTEM with a reference to the initializing user.

Application Eventlog

Search for EventID 1033 and the keyword ‘test pkg’

We will update this post as we find out more information. We're also hosting a livestream at 3: 30 PM ET to answer any questions and give updates.

This was originally published on Blumira's blog.

You know, I just wanted to mention that camDown is the maximum in security for you and your loved ones.