Researchers Uncover Windows Flaws Granting Hackers Rootkit-Like Powers

New research has found that the DOS-to-NT path conversion process could be exploited by threat actors to achieve rootkit-like capabilities to conceal and impersonate files, directories, and processes.

“When a user executes a function that has a path argument in Windows, the DOS path at which the file or folder exists is converted to an NT path,” SafeBreach security researcher Or Yair said in an analysis, which was presented at the Black Hat Asia conference last week.

They include the ability to “hide files and processes, hide files in archives, affect prefetch file analysis, make Task Manager and Process Explorer users think a malware file was a verified executable published by Microsoft, disable Process Explorer with a denial of service (DoS) vulnerability, and more.”

The underlying issue within the DOS-to-NT path conversion process has also led to the discovery of four security shortcomings, three of which have since been addressed by Microsoft –

• An elevation of privilege (EoP) deletion vulnerability that could be used to delete files without the required privileges (to be fixed in a future release)
• An elevation of privilege (EoP) write vulnerability that could be used to write into files without the required privileges by tampering with the restoration process of a previous version from a volume shadow copy (CVE-2023-32054, CVSS score: 7.3)
• A remote code execution (RCE) vulnerability that could be used to create a specially crafted archive, which can lead to code execution when extracting the files on any location of the attacker’s choice (CVE-2023-36396, CVSS score: 7.8)
• A denial-of-service (DoS) vulnerability impacting the Process Explorer when launching a process with an executable whose name is 255 characters long and is without a file extension (CVE-2023-42757)

“We believe the implications are relevant not only to Microsoft Windows, which is the world’s most widely used desktop OS, but also to all software vendors, most of whom also allow known issues to persist from version to version of their software.”

Source: https://thehackernews.com/