NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

A previously undetected attack technique referred to as NoFilter has been identified to abuse the Windows Filtering System (WFP) to achieve privilege escalation in the Windows operating procedure.

“If an attacker has the skill to execute code with admin privilege and the target is to accomplish LSASS Shtinkering, these privileges are not more than enough,” Ron Ben Yizhak, a security researcher at Deep Intuition, informed The Hacker News.

“Running as “NT AUTHORITYSYSTEM” is essential. The techniques described in this investigation can escalate from admin to System.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The results ended up introduced at the DEF CON security conference over the weekend.

The setting up issue of the investigate is an in-house tool identified as RPC Mapper the cybersecurity company applied to map remote treatment contact (RPC) procedures, particularly those that invoke WinAPI, leading to the discovery of a method named “BfeRpcOpenToken,” which is element of WFP.

WFP is a set of API and procedure companies that’s utilised to system network site visitors and make it possible for configuring filters that permit or block communications.

“The take care of desk of yet another approach can be retrieved by calling NtQueryInformationProcess,” Ben Yizhak said. “This desk lists the tokens held by the approach. The handles to these tokens can be duplicated for yet another process to escalate to Program.”

While access tokens serve to determine the user included when a privileged process is executed, a piece of malware functioning in user manner can entry tokens of other processes utilizing particular features (e.g., DuplicateToken or DuplicateHandle) and then use that token to launch a baby procedure with Program privileges.

But the aforementioned method, for every the cybersecurity company, can be modified to accomplish the duplication in the kernel via WFP, producing it equally evasive and stealthy by leaving scarcely any evidence or logs.

In other phrases, the NoFilter can launch a new console as “NT AUTHORITYSYSTEM” or as an additional user that is logged on to the machine.

“The takeaway is that new attack vectors can be uncovered by on the lookout into created-in components of the OS, these types of as the Windows Filtering Platform,” Ben Yizhak stated, introducing the solutions “stay away from WinAPI that are monitored by security products.”

Uncovered this posting exciting? Abide by us on Twitter  and LinkedIn to examine far more special articles we publish.