Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1106525" data-attributes="member: 32260">I had in mind if you tried to kill Comodo in that way instead of bypassing the sandbox.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />I assume that the benign application in your test does not ask for elevation so you used bypass to to elevate in the sandbox and create the service. Next, the service could run DLL hijacking with high privileges. I think that the same can be done without the containment bypass just by running the benign application with admin rights (via &quot;Run as administrator&quot;) to apply DLL hijacking and run TDSSKiller. But I am not sure if anyone tried this against Comodo.</blockquote>

[QUOTE="Andy Ful, post: 1106525, member: 32260"] I had in mind if you tried to kill Comodo in that way instead of bypassing the sandbox.:)(y) I assume that the benign application in your test does not ask for elevation so you used bypass to to elevate in the sandbox and create the service. Next, the service could run DLL hijacking with high privileges. I think that the same can be done without the containment bypass just by running the benign application with admin rights (via "Run as administrator") to apply DLL hijacking and run TDSSKiller. But I am not sure if anyone tried this against Comodo. [/QUOTE]

Verification