Published in Posts By SpecterOps Team Members·Nov 15, 2019CVE-2019–12757: Local Privilege Escalation in Symantec Endpoint ProtectionSymantec Endpoint Protection Version: 14.2 RU1 Build 3335 (14.2.3335.1000) and below Operating System Tested On: Windows 10 1803 x64 This vulnerability was found in conjunction with Marcus Sailler, Rick Romo and Gary Muller of Capital Group’s Security Testing Team Preconditions: In order for this vulnerability to be reliably exploited, Symantec…Security5 min read
Published in Posts By SpecterOps Team Members·Aug 29, 2019Avira Optimizer Local Privilege EscalationVersion: Avira Optimizer < 1.2.0.367 Operating System tested on: Windows 10 1803 (x64) Vulnerability: Avira Optimizer Local Privilege Escalation through insecure named pipes Vulnerability Overview When users install the latest Avira antivirus, it comes shipped with a few different components along with it by default. One of these components is…Security7 min read
Published in Posts By SpecterOps Team Members·Jul 24, 2019CVE-2019–13382: Local Privilege Escalation in SnagItVersion: Snagit 2019.1.2 Build 3596 Operating System tested on: Windows 10 1803 (x64) Vulnerability: SnagIt Relay Classic Recorder Local Privilege Escalation through insecure file move This vulnerability was found in conjunction with Marcus Sailler, Rick Romo and Gary Muller of Capital Group’s Security Testing Team Vulnerability Overview Every 30–60 seconds…Security7 min read
Published in Posts By SpecterOps Team Members·Jul 5, 2019CVE-2019–13142: Razer Surround 1.1.63.0 EoPVersion: Razer Surround 1.1.63.0 Operating System tested on: Windows 10 1803 (x64) Vulnerability: Razer Surround Elevation of Privilege through Insecure folder/file permissions Purpose I hope that this post serves as a motivator for folks who see vulnerability research as an intimidating area to get started in. While this bug can…Security5 min read
Published in Posts By SpecterOps Team Members·Jan 21, 2019Razer Synapse 3 Elevation of PrivilegeProduct Version: Razer Synapse 3 (3.3.1128.112711) Windows Client Downloaded from: https://www.razer.com/downloads Operating System tested on: Windows 10 1803 (x64) Vulnerability: Razer Synapse Windows Service EoP Brief Description: The Razer Synapse software has a service (Razer Synapse Service) that runs as “NT AUTHORITY\SYSTEM” and loads multiple .NET assemblies from “C:\ProgramData\Razer\*”. The…Cybersecurity8 min read
Published in Posts By SpecterOps Team Members·Oct 23, 2018CVE-2018–8414: A Case Study in Responsible DisclosureThe process of vulnerability disclosure can be riddled with frustrations, concerns about ethics, and communication failure. I have had tons of bugs go well. I have had tons of bugs go poorly. I submit a lot of bugs, through both bounty programs (Bugcrowd/HackerOne) and direct reporting lines (Microsoft). I’m not…Security12 min read
Published in Posts By SpecterOps Team Members·Oct 10, 2018CVE-2018–8212: Device Guard/CLM bypass using MSFT_ScriptResourceDevice Guard and the enlightened scripting environments that come with it are a lethal combination for disrupting attacker activity. Device Guard will prevent unapproved code from executing while placing scripting languages such as PowerShell and the Windows Scripting Host in a locked down state. In order to operate in such…Microsoft4 min read
Published in Posts By SpecterOps Team Members·Jun 11, 2018The Tale of SettingContent-ms FilesAs an attacker, initial access can prove to be quite the challenge against a hardened target. When selecting a payload for initial access, an attacker has to select a file format that allows arbitrary code execution or shell command execution with minimal user interaction. These file formats can be sparse…Security9 min read
Published in Posts By SpecterOps Team Members·Jan 29, 2018Reviving DDE: Using OneNote and Excel for Code ExecutionTL;DR: You can achieve DDE execution with Excel SpreadSheets embedded within OneNote. This bypasses the original Excel mitigation ruleset (Microsoft has released a patch to properly mitigate this) as well as the Protected View sandbox 🙂 Dynamic Data Exchange (DDE) has been a hot topic as of late. For those…Excel6 min read
Published in Posts By SpecterOps Team Members·Nov 16, 2017Lateral Movement Using Outlook’s CreateObject Method and DotNetToJScriptIn the past, I have blogged about various methods of lateral movement via the Distributed Component Object Model (DCOM) in Windows. This typically involves identifying a DCOM application that has an exposed method allowing for arbitrary code execution. In this example, I’m going to cover Outlook’s CreateObject() method. If you…Dcom4 min read
