Sårbarheder i MMC tillader at tage kontrol over systemet

Microsoft Management Console (MMC), bruges af systemadministratorer til at konfigurere og spore systemets ydeevne, indeholder en række sårbarheder, ved hjælp af hvilke angribere kan gennemføre malware eller opsnappe kontrol på angrebet maskine.

The vulnerability group, which includes XSS og XXE bugs, received a common identifier CVE-2019-0948. Angribere kan udnytte problemer ved hjælp af snap-in mekanisme i MMC. Snap-ins are small programs that allow customizing different aspects of the system.

In order to exploit the vulnerability, an attacker will need to create a file with the .msc udvidelse, containing specially crafted XML content, and then convince an authorized user (For eksempel, using social engineering) to import this file.

As the researchers from Check Point, who discovered the bugs, explained, an attacker can create a file with the Link to Web Address snap-in (link to a web-resource) and include a link to its own server, thus redirecting to a page with malicious code.

“We have successfully managed to insert malicious URL link that contains malicious payloads such as redirection to SMB server that will capture the user NTLM hash”, - rapport forskere.

På samme måde, an attacker can create a file with the ActiveX Control snap-in and save it as an .msc file by changing the string value in the StringsTables section to a malicious URL controlled by it.

The attacker chooses an ActiveX Control snap-in
The attacker chooses an ActiveX Control snap-in

Ifølge eksperter, MMC files are used by system administrators and are not considered antivirus software as malicious. Cybercriminals can take advantage of it to control of a PC with administrator status and further advance over the network.

The problems affect versions of vinduer 7, vinduer 8.1, vinduer 10 og Windows Server 2008Windows Server 2019. Microsoft has allerede fastsat vulnerabilities with the release of June service pack. I øjeblikket, there are no cases of bugs’ exploitation.

Reference:

Microsoft Management Console (MMC) is a tool for opening, creating, and saving administration tools (called MMC consoles) that manage hardware, software, og netværkskomponenter i MS Windows-operativsystemet.

Kilde: https://research.checkpoint.com

Om Trojan Killer

Carry Trojan Killer Portable på din memory stick. Vær sikker på, at du er i stand til at hjælpe din pc modstå eventuelle cyber trusler, hvor du går.

Tjek også

MageCart på Heroku Cloud Platform

Forskere har fundet flere MageCart Web Forplove On Heroku Cloud Platform

Forskere ved Malwarebytes rapporteret om at finde flere MageCart web skummere på Heroku cloud-platform …

Android Spyware CallerSpy

CallerSpy spyware masker som en Android chat applikation

Trend Micro eksperter opdagede malware CallerSpy, hvilke masker som en Android chat program og, …

Skriv et svar