In July 2022, Microsoft patched a well-known PPL bypass flaw, initially discovered by Ionescu and Forshaw.
This allowed protection circumvention without kernel code execution, and this update now broke the PPLdump PoC.
SCRT Team researchers at Orange Cyberdefense recently discovered a new exploit that enables threat actors to bypass LSASS protection. This new exploit was dubbed “BYOVDLL” (Bring Your Own Vulnerable DLL).
Technical Analysis
However, in October 2022 Gabriel Landau disclosed that the vulnerability remained un-patched through “Bring Your Own Vulnerable DLL” approach and successfully ran PPLdump without any necessary tweaks.
Free Webinar on Detecting & Blocking Supply Chain Attack -> Book your Spot
This demonstration triggered interest in looking into arbitrary code execution in protected processes by different DLLs, especially not requiring system reboots against Microsoft’s attempted patching efforts.
Two tiers of Windows system protection, namely Protected Process (PP) and Protected Process Light (PPL), exist with different signers defining a grading or ranking of security.
LSASS, which is a PPL, proves to be a primary focus for in-memory credential extraction since it has a wider attack surface compared to the other high-level PPs.
KeyIso service within LSASS had two serious vulnerabilities:-
Exploiting these required loading vulnerable versions of both keyiso.dll and ncryptprov.dll into LSASS.
This was done through several steps such as changing registry settings to load a vulnerability keyiso.dll, extracting and properly signing the DLL, and then registering a custom Key Storage Provider to load a vulnerable ncryptprov.dll.
Notably, this exploit method bypassed Windows’ security measures without requiring rebooting the system, showing how sensitive the present balance is between making your systems secure while still having exploitable areas.
The successful execution of this exploit highlights persistent difficulties in defending critical system processes against sophisticated attack vectors like those targeting credential theft from seemingly protected processes.
Within the protected LSASS process, the exploit chain was tested successfully by employing vulnerable versions of keyiso.dll and ncryptprov.dll.
To circumvent PPL restrictions, which prevent loading unsigned DLLs, the original LoadLibraryW call was replaced with OutputDebugStringW.
This change meant instead of relying on Process Monitor to detect filesystem events there could be an execution confirmation through DebugView.
.webp "A New Exploit That Is Bypassing LSASS Protection 1")
The steps in exploiting involved restarting KeyIso service and registering a custom Key Storage Provider.
After executing the proof-of-concept code, the debug message “I’m in LSASS!!!” confirmed successful arbitrary code execution in this secure environment.
.webp "A New Exploit That Is Bypassing LSASS Protection 2")
This demonstration proved that bringing your own vulnerable dll is a valid technique for re-introducing and exploiting patches against high-security vulnerabilities (CVE-2023-36906 and CVE-2023-28229).
Though only displaying a debug message, it also laid the foundation for more sophisticated exploitation techniques within secured processes.
Are you from SOC and DFIR Teams? Analyse Malware Incidents & get live Access with ANY.RUN -> Get 14 Days Free Acces