Inject Malicious Code Into Antivirus

I. STARTER

When conducting penetration testing on target machines, our actions will be
ruthlessly monitored and judged by Antivirus. If deemed dangerous, our payload
will be removed from the system, or worse, we may lose access to the target
machine entirely.

However, there are always processes considered exceptions. These are the
processes of the Antivirus itself. Suppose you are an Antivirus software
developer, you cannot risk terminating a process or deleting files related to
your software in a live environment, right? This would compromise the
functionality of the Antivirus and could lead to instability. All of this
would significantly affect the user experience.

In this article, I will experiment with the technique of injecting code into
the protected processes of several Antivirus programs. After a successful
injection, I can perform actions that are not permitted for regular processes
(regardless of the user permissions). The simplest example is writing a
backdoor into the installation folder of the Antivirus.

Find me on X to get the latest pentest and red team tricks that I’ve been
researching: Two Seven One Three (@TwoSevenOneT) / X

II. MAIN SECTION

1. How Antivirus Protects Its Processes

Antivirus programs protect their own processes from being killed or accessed
by using several methods, including running with high-level privileges, using
process introspection to monitor for tampering, and employing self-protection
mechanisms like automatically restarting or triggering alerts when attacks are
detected.

• Elevated privileges: Antivirus software is granted high-level permissions to
  perform its functions (usually with SYSTEM privileges)
• Process introspection: This technique involves the antivirus monitoring its
  own processes for suspicious activities, such as the creation of new threads
  or the injection of code by an external process.
• Code integrity checks: The antivirus performs checks on its own code and
  modules to ensure that they have not been tampered with.
• Run as System-protected process: Antivirus uses the Protected Process Light
  (PPL) feature of Windows to keep its user-mode processes separate from other
  processes.
• Kernel-mode protection: To protect the core of the operating system,
  antivirus solutions deploy sensors to detect and block third-party
  components from altering their detection capabilities within the
  kernel. 

2. How Antivirus Determines Which Processes Need To Be Protected

Put yourself in the shoes of an Antivirus developer. When coding this
self-protection feature, how would you determine which processes belong to the
protected list?

• Based on the process name: attackers will create a file with a
  similar name and execute that file.
• Based on the file signature: threat actors will copy your original
  file and perform DLL hijacking.
• Based on the process ImagePath: ensuring the executable file is
  placed correctly will make it very difficult for attackers to spoof it.

In practice, Antivirus software combines checks on the process
ImagePath with preventing file writing operations in its installation
folder. Additionally, it may include signature verification of DLLs loaded
into the processes on the protected list (as seen in Bitdefender).

Don’t even consider spoofing the ImagePath by modifying the
PEB of the process. Antivirus software typically monitors your process
right from its initialization using a kernel driver.

And don’t think about calling CreateProcess to create a protected
process, then using the handle obtained from the CreateProcess API to
manipulate it. Because when a process is initialized and identified by the
Antivirus as being on the protected list, your handle will have no power
anymore.

3. Ideas For Injecting Code Into Processes Protected By Antivirus

Antivirus developers are often very intelligent individuals with strong
programming skills. Their weakness lies in the necessity to develop software
that operates based on the operating system while balancing user experience,
performance, and the effectiveness of the Antivirus.

An antivirus product typically comes with many features. For example, modern
antivirus solutions often include modules for firewall management, browser
monitoring, VPN (Virtual Private Network), and user interface(For example,
with Avast Antivirus, instead of injecting into the processes of the Antivirus
services, I can inject into the GUI process, which is also protected) handling
for user interaction.

Naturally, the processes that perform the functions of these modules will also
be included in the protected list and granted privileges such as writing files
to the Antivirus installation folder and being classified as non-threat
processes.

For protected processes, we cannot kill or restart them, nor can we modify the
services/tasks configuration to disable them. At most, we can only suspend
them using
EDR-Freeze. Of course, if you have an exploit that escalates privileges to the kernel,
everything becomes much simpler.

In fact, there is a way to restart these processes, which is to reboot the
machine. However, during pentesting activities, restarting the target
machine is a last resort.

If I cannot Start/Stop the protected processes, I would attempt to create a
new Windows service with the exact same configuration information as the
Antivirus service to see what happens.

Since you’re performing a manual service clone operation
(exporting-importing the registry key), you’ll need to restart the test
machine so that Services.exe can load the newly created service into the
cache.

So now I can proactively run a service with the executable file as the
Antivirus service file. Next, I need to check if the newly launched service is
protected or not.

A simple way to check is to use Process Explorer to kill the newly
created process. If it is protected, you will receive an “access denied” message.

When we successfully create a protected service, it means we can monitor the
initialization process of this service, providing more opportunities to
exploit this initialization.

Windows Cryptography API (CryptoAPI) Infrastructure:

Antivirus programs often need to perform operations such as encryption,
decryption, hashing, and digital signature verification. Therefore, I would
exploit this position to inject code into the processes of the Antivirus.

HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider

For example, with Bitdefender that I am currently testing, it uses the “Microsoft Enhanced RSA and AES Cryptographic Provider” during startup. If I change the registry value to point to a different DLL,
I could inject into this process.

The next issue is that Bitdefender will check the digital signatures of the
loaded modules. We can bypass this by trusting our self-signed digital
signature. However, I have a better idea, we can
clone the digital signatures of legitimate programs
on Windows to conceal ourselves more effectively.

Here are the steps to inject code into the process of Antivirus:

1. Create a Protected Service: Clone a service that matches the configuration
   of the Antivirus service.
2. Modify Cryptographic Provider: Change the registry value to point to a
   custom DLL that you control.
3. Trust Self-Signed Signature: Either trust your self-signed digital signature
   or clone the digital signature of legitimate Windows programs for better
   concealment.
4. Run the newly cloned service: activate this service so that the
   initialization process loads the malicious Cryptographic Provider. 
5. Verify Injection: Confirm that your code is running.
6. Restore the modified Cryptographic Provider registry to its original value
   to ensure the system operates normally.

4. Introducing The IAmAntimalware Tool

To carry out the above steps, I have created a tool called
IAmAntimalware. This tool will clone a service by name, modify the
Cryptographic Provider, import the certificate, and start the cloned
service.

You can download this tool at the link:

https://github.com/TwoSevenOneT/IAmAntimalware

I will experiment with the IAmAntimalware tool alongside
Bitdefender Antivirus.

First, I will use the CertClone tool to sign my DLL.

You can download CertClone tool at the link:

https://github.com/TwoSevenOneT/CertClone

Next, I will copy the file “sysmon_Clone.cer” and the signed PE file
“SampleDll.dll” to the target machine.

“SampleDll.dll” is a simple test file that calls
OutputDebugString and writes a file named “mark.txt” in the
installation folder of the Antivirus.

I will execute IAmAntimalware with the following parameters:

IAmAntimalware.exe BDProtSrv BDProtSrv02 sysmon_Clone.cer
C:\TMP\SampleDll.dll

BDProtSrv and BDProtSrv02 are the names of the original service
and the clone to be created. sysmon_Clone.cer is the file exported from
the CertClone tool. Finally, the path to the DLL file that needs to be
injected must be specified, with an absolute path requirement.

Besides the Cryptographic Provider, the IAmAntimalware tool also
supports hijacking via COM objects. You can try experimenting with this in
practice.

After successfully running, I was able to inject SampleDll.dll into the
Antivirus process. Evidence of this is that I was able to successfully write a
file in its installation folder.

I also successfully tested with Trend Micro Antivirus and Avast. For Avast,
the most stable method is to trigger the GUI process, so you need to modify
IAmAntimalware to be compatible with this antivirus.

III. ENDING

Antivirus programs always have a self-protection feature for their service
processes. Simply put, these processes are unkillable.

If it is possible to execute code within these processes, malware could bypass
antivirus programs and carry out dangerous activities without being stopped.
This creates a condition that is too good to be true for malware developers.

IAmAntimalware takes advantage of cloning a protected service, along
with a digitally signed certificate that is force-trusted, to inject code into
the processes of the Antivirus.

To prevent this technique, it’s essential to monitor module loading for
unusual paths, check for added trusted certificates in the Windows registry,
and combine this with the use of the
Protected Processes Light (PPL) feature.

IV. READING

Here are some books you should read to beef up your knowledge about
cybersecurity:

Hacking: The Art of Exploitation, 2nd Edition

Spies, Lies, and Cybercrime: Cybersecurity Tactics to Outsmart Hackers and
Disarm Scammers

Fancy Bear Goes Phishing: The Dark History of the Information Age, in Five
Extraordinary Hacks

Author of the article: Two Seven One Three