And since it's an arbitrary file deletion, we can easily use it to exploit the MSI installer rollback to achieve privilege escalation :)
https://t.co/gwBdYHeJWx
Shoutout to the homies at "IObit Malware Fighter".
Their IMFForceDelete driver is so wildly vulnerable, and poorly written, you can have their driver arbitrarily delete any file on the machine with 0 privileges and literally 1 line of code
Thanks @_mmpte_software for sharing
@provocateur_io@SFNloubnan you think the U.S. doesn’t have transportation? They don’t need Al Boraq to go from LA to San Francisco in 3 hours they already have flights that take only about 1 hour and 20 minutes.
@smakosh@yezz123 We can go even lower
kfta dyal djaj : 300dh
lma dyal bir : free
internet : 50dh mchrok m3a bzf nas
khbz karm: 10dh ( 7to f ma bach yrtab )
srdine : laknti 9rib b7ar sydo
kra : camping tent
@rustdesk@ESET@anydesk@TeamViewer No idea, but from my point of view, a threat actor can easily deploy it stealthily, while other remote desktop apps are harder due to the message box that appears when someone tries to connect.
@0x_alibabas Thanks. didn’t try BaitAndSwitch. when I suggested a redirect policy, it wasn’t an option they said it was incompatible with their SDK. It also took a long time for them to implement a fix, so I gave up testing.
I’ve released a PoC and a technical write-up for a local privilege escalation vulnerability I discovered last year and reported to Lenovo PSIRT, affecting many gaming laptop brands, including Lenovo, MSI, Thunderobot, and others.
https://t.co/f5K1JfGu8S
@7N7 Then calls DuplicateHandle with the DUPLICATE_CLOSE_SOURCE option which should close it in the source process allowing you to open it freely and dump everything without the user noticing.
@7N7 2. The last issue was that browser processes open the cookies database file with sharing flags that prevent other processes from accessing it. To bypass that you can enumerate handles until you find the right one via NtQuerySystemInformation
@7N7 If I remember correctly, if the user is already using the browser and you inject the DLL, it closes once creds are dumped. I didn’t look deeply, but I just run the browser with a new profile (since you can’t spawn two instances), headless then inject dll and pull data via RPC.
@7N7 Yeah it’s a lot of effort since you have to handle both ABE and the classic one in ABE some maldevs focus on stealth while others don’t because the browser closes and users notice i can share what I did if you’re interested or you can figur it out yourself if you like challenges.
@AUZombie This is their builder. You can see the features since it checks authentication on the client side if you set the response of /api/users to true.