Cybersecurity researchers have detailed 4 totally different vulnerabilities in a core part of the Home windows job scheduling service that might be exploited by native attackers to attain privilege escalation and erase logs to cowl up proof of malicious actions.
The problems have been uncovered in a binary named “schtasks.exe,” which allows an administrator to create, delete, question, change, run, and finish scheduled duties on a neighborhood or distant laptop.
“A [User Account Control] bypass vulnerability has been present in Microsoft Home windows, enabling attackers to bypass the Person Account Management immediate, permitting them to execute high-privilege (SYSTEM) instructions with out consumer approval,” Cymulate safety researcher Ruben Enkaoua mentioned in a report shared with The Hacker Information.
“By exploiting this weak point, attackers can elevate their privileges and run malicious payloads with Directors’ rights, resulting in unauthorized entry, knowledge theft, or additional system compromise.”
The issue, the cybersecurity firm mentioned, happens when an attacker creates a scheduled job utilizing Batch Logon (i.e., a password) versus an Interactive Token, inflicting the duty scheduler service to grant the working course of the utmost allowed rights.
Nonetheless, for this assault to work, it hinges on the risk actor buying the password by another means, akin to cracking an NTLMv2 hash after authenticating in opposition to an SMB server or exploiting flaws akin to CVE-2023-21726.
A internet results of this problem is {that a} low-privileged consumer can leverage the schtasks.exe binary and impersonate a member of teams akin to Directors, Backup Operators, and Efficiency Log Customers with a identified password to acquire the utmost allowed privileges.
The registration of a scheduled job utilizing a Batch Logon authentication methodology with an XML file can even pave the best way for 2 protection evasion methods that make it potential to overwrite Job Occasion Log, successfully erasing audit trails of prior exercise, in addition to overflow Safety Logs.
Particularly, this entails registering a job with an writer with the identify, say, the place the letter A is repeated 3,500 instances, within the XML file, inflicting all the XML job log description to be overwritten. This habits might then be prolonged additional to overwrite the entire “C:WindowsSystem32winevtlogsSafety.evtx” database.
“The Job Scheduler is a really attention-grabbing part. Accessible by anybody prepared to create a job, initiated by a SYSTEM working service, juggling between the privileges, the method integrities and consumer impersonations,” Enkaoua mentioned.
“The primary reported vulnerability just isn’t solely a UAC Bypass. It’s excess of that: it’s basically a option to impersonate any consumer with its password from CLI and to acquire the utmost granted privileges on the duty execution session, with the /ru and /rp flags.”
