Cybersecurity researchers have detailed 4 totally different vulnerabilities in a core part of the Home windows activity scheduling service that might be exploited by native attackers to realize privilege escalation and erase logs to cowl up proof of malicious actions.
The problems have been uncovered in a binary named “schtasks.exe,” which permits an administrator to create, delete, question, change, run, and finish scheduled duties on an area or distant pc.
“A [User Account Control] bypass vulnerability has been present in Microsoft Home windows, enabling attackers to bypass the Person Account Management immediate, permitting them to execute high-privilege (SYSTEM) instructions with out person approval,” Cymulate safety researcher Ruben Enkaoua mentioned in a report shared with The Hacker Information.
“By exploiting this weak point, attackers can elevate their privileges and run malicious payloads with Directors’ rights, resulting in unauthorized entry, information theft, or additional system compromise.”
The issue, the cybersecurity firm mentioned, happens when an attacker creates a scheduled activity utilizing Batch Logon (i.e., a password) versus an Interactive Token, inflicting the duty scheduler service to grant the working course of the utmost allowed rights.
Nonetheless, for this assault to work, it hinges on the menace actor buying the password by another means, corresponding to cracking an NTLMv2 hash after authenticating towards an SMB server or exploiting flaws corresponding to CVE-2023-21726.
A web results of this concern is {that a} low-privileged person can leverage the schtasks.exe binary and impersonate a member of teams corresponding to Directors, Backup Operators, and Efficiency Log Customers with a recognized password to acquire the utmost allowed privileges.
The registration of a scheduled activity utilizing a Batch Logon authentication methodology with an XML file also can pave the best way for 2 protection evasion methods that make it potential to overwrite Process Occasion Log, successfully erasing audit trails of prior exercise, in addition to overflow Safety Logs.
Particularly, this entails registering a activity with an writer with the identify, say, the place the letter A is repeated 3,500 instances, within the XML file, inflicting your complete XML activity log description to be overwritten. This habits might then be prolonged additional to overwrite the entire “C:WindowsSystem32winevtlogsSecurity.evtx” database.
“The Process Scheduler is a really attention-grabbing part. Accessible by anybody keen to create a activity, initiated by a SYSTEM working service, juggling between the privileges, the method integrities and person impersonations,” Enkaoua mentioned.
“The primary reported vulnerability isn’t solely a UAC Bypass. It’s excess of that: it’s primarily a method to impersonate any person with its password from CLI and to acquire the utmost granted privileges on the duty execution session, with the /ru and /rp flags.”