Pierluigi Paganini
April 22, 2024
SafeBreach researcher Or Yair devised a technique, exploiting vulnerabilities in the DOS-to-NT path conversion process, to achieve rootkit-like capabilities on Windows.
When a user executes a function with a path argument in Windows, the DOS path of the file or folder is converted to an NT path. However, a known issue arises during this conversion process where the function removes trailing dots from any path element and trailing spaces from the last path element. This behavior is consistent across most user-space APIs in Windows.
The expert exploiting this known issue discovered the following vulnerabilities:
“In addition to leading me to these vulnerabilities, the MagicDot paths also granted me rootkit-like abilities that were accessible to any unprivileged user.” wrote Or Yair. “I discovered how a malicious actor—without admin privileges—could hide files and processes, hide files in archives, affect prefetch file analysis, make Task Manager and Process Explorer users think a malware file was a verified executable published by Microsoft, disable Process Explorer with a denial of service (DoS) vulnerability, and more.”
A user-space rootkit aims to intercept user-space API calls, execute the original function, filter out malicious data, and return altered information to the caller. An attacker needs Admin privileges to run such rootkits, as they need to conceal their presence from users, including administrators, by operating within processes with elevated privileges.
A kernel rootkit operates within the kernel and attempts to intercept system calls, altering the information returned to user-space processes that request it.
Running a kernel rootkit requires access to the kernel, typically requiring administrative privileges and overcoming various security measures such as Patch Guard, Driver Signature Enforcement, Driver Blocklist, and HVCI. Consequently, the prevalence of kernel rootkits has decreased significantly.
The expert reported to the Microsoft Security Response Center (MSRC) in 2023. The IT giant acknowledged these issues and took the following action:
“This research is the first of its kind to explore how known issues that appear to be harmless can be exploited to develop vulnerabilities and, ultimately, pose a significant security risk. We believe the implications are relevant not only to Microsoft Windows, which is the world’s most widely used desktop OS, but also to all software vendors, most of whom also allow known issues to persist from version to version of their software.” Yair concluded.
The report includes video PoCs for these vulnerabilities-
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Microsoft)
