4 ms·
Proof of concept WMI virus (zero-day)
- Almondsetat 2y agoQuoting the README: "The WMI is an extension of the Windows Driver Model. It's a CIM interface that provides all kinds of information about the system hardware, and provides for a lot of the core functionality in Windows. For example, when you create a startup registry key for an an application, that's really acting on the WMI at boot."
- alberto-m 2y agoFrom a Reddit comment [1]: “the repo contains two novel and different ways to run any process as the SYSTEM user. It also disables every antivirus through a novel process privilege deescalation exploit” [1] https://old.reddit.com/r/ReverseEngineering/comments/1icgfua/got_bored_reversed_the_wmi_made_a_novel_virus/ https://old.reddit.com/r/ReverseEngineering/comments/1icgfua...
- jolfosh 2y agoThe fact that so many critical infrastructure systems still depend on Windows is absurd (I say from my Windows machine). Great find! Thank you for sharing.
- kachapopopow 2y agoAh, good to know that there's people still making a complete mockery of windows even now. Do note that VBS mitigates a majority of 'buffer overflow' exploits and Microsoft has historically shown to brush off these vulnerabilities so that 100k bounty is pretty far fetched. Any WMI operation does touch the disk (because it's a database), but similar to any kind of other database they're mixed with writes that happen in a normal environment and are not really possible to tell between malicious applications. WMI requires administrator privileges to write so the privilege escalation is not that interesting except in limited environments (and Microsoft has also shown in the past that they don't care about these), which is fair considering you can't call 'sudo' a security vulnerability.
- b8 2y agoZerodium and similar 0day sweatshops pays a lot for these 0days. Bug bounty programs directly thru the companies have been documented to screw over researchers.
- tptacek 2y agoZero-day brokers pay in tranches for completed reliable exploits; bug bounties pay in lump sums for (generally) POCs. It's not an apples-apples comparison.
- kachapopopow 2y agoCan confirm.
- b8 2y agoZDI pays lump sums AFAIU.
- tptacek 2y agoZDI is more like a bug bounty than a grey market broker.
- deleted 2y ago[deleted]
- NetOpWibby 2y agoI wonder why this person didn’t submit this to Microsoft for a billion dollars.
- musjleman 2y agoBecause this has no actual value for anyone and MS would (did?) ignore him.
- NetOpWibby 2y agoSurely MS has bug bounty programs, no? Maybe I'm missing something.
- p_ing 2y agoYes they do for credible threats. Otherwise there is the Windows Feedback Hub ;)
- musjleman 2y agoYou're missing the fact that there is basically no bug here. All this does is: * Store data in a database. * Kill AV software provided you have admin privileges. The latter might be remediated by MS down the line, but they don't generally give bounties.
- NetOpWibby 2y agoYeah, the AV thing was what gave me pause. The only thing I miss about Windows is ESET's Nod32. Best AV I've ever used. I know they have a Mac version now but I don't see the point in getting it.
- ComputerGuru 2y agoThe real value in this: a new way to more easily disable Windows Defender on Windows 11.
- EvanAnderson 2y agoPersistence inside the WMI database is fun. There was a good talk about this at DerbyCon[0] years ago. I think it has gotten more press since several APT groups were using it but it still isn't a well-known persistence mechanism. [0] https://www.irongeek.com/i.php?page=videos/derbycon5/break-me12-whymi-so-sexy-wmi-attacks-real-time-defense-and-advanced-forensic-analysis-matt-graeber-willi-ballenthin-claudiu-teodorescu https://www.irongeek.com/i.php?page=videos/derbycon5/break-m...
- ptx 2y agoSo where is the data actually stored if it "never touches the disk"? Is it some UEFI or BIOS thing?