New Windows zero-day with public exploit lets you become an admin

[Andy Ful]

I tried this exploit on my computer (with Edge + Defender + SWH), but it was very hard:

1. The download was blocked by Edge and I had to use "keep anyway" 3 times until Edge allowed it.
2. The file was detected by Defender and when allowed, the execution was blocked by SmartScreen.
3. Next, I tried another attack vector and downloaded the sample in the ZIP archive. After opening the downloaded file from Edge the Explorer window was displayed, so I clicked the InstallerFileTakeOver to execute the exploit. The execution was blocked by SmartScreen and next by SRP in the user Temp folder (where the archive was unpacked).
4. Finally, I manually unpacked the ZIP archive and clicked on InstallerFileTakeOver executable. It was blocked by SmartScreen. In this case, the file was blocked thanks to the Windows built-in unpacker which preserves the MOTW (file could be executed if I would use 7-ZIP).

The author noted that his exploit can bypass the Windows policy that restricts MSI Installer. So, I changed the SRP setup to allow EXE files but block MSI files and checked if the exploit can bypass SRP restrictions for MSI Installer. It did not. After executing InstallerFileTakeOver, it dropped the MSI file to the random subfolder in the user TEMP folder. The execution of this file was blocked by SRP and the exploit failed.

 

[wat0114]

It seems that you have run pkg.msi file instead of the InstallerFileTakeOver.exe

It seems you are right I saw "Test" in the msi file name and jumped the gun.

new results with correct file. All kinds of barriers prevented it. I had to disable Defender's Real time scanning so that H_C SRP rules would block it.:

 

[South Park]

I downloaded the test .exe in Firefox, which was instantly blocked by Windows Defender. However, WD couldn't finish cleanup and kept asking me to quick scan and then quarantine or delete the file manually (seven times before I gave up), even after a restart, effectively causing a denial of service. This has happened to me before with test files, including ones endorsed by Microsoft. I ultimately resolved the issue by replacing WD with another product I have a license for.

 

[Andy Ful]

I downloaded the test .exe in Firefox, which was instantly blocked by Windows Defender. However, WD couldn't finish cleanup and kept asking me to quick scan and then quarantine or delete the file manually (seven times before I gave up), even after a restart, effectively causing a denial of service. This has happened to me before with test files, including ones endorsed by Microsoft. I ultimately resolved the issue by replacing WD with another product I have a license for.

When doing the same with Edge and bypassing the Edge alerts, the file InstallerFileTakeOver.exe was downloaded to the Downloads folder as "Unconfirmed 257482.crdownload". The Defender alerted that the file InstallerFileTakeOver.exe was blocked. I looked at the threat history and chose to delete the file. But, "Unconfirmed 257482.crdownload" was not deleted. I used right-click option to scan the file by Defender and the file was rescanned and finally removed.
After some time I did the download the second time and the result was different. The file was blocked by Defender but Defender removed it automatically.

I think that such leftovers as "Unconfirmed 257482.crdownload" are probably automatically removed only after the malware signature is added to the offline database.

Edit.
In the case of Firefox the file is downloaded as InstallerFileTakeOver.exe and the file is locked by Defender (cannot be executed).

 

[wat0114]

Edit.
In the case of Firefox the file is downloaded as InstallerFileTakeOver.exe and the file is locked by Defender (cannot be executed).

I see varying, inconsistent actions sometimes, although in the end, and most importantly, Defender and/or Smartscreen block/warns of the download. I tried the download with Firefox minutes ago, and Windows Security issued two consecutive warnings, and then when I tried to execute it from the Downloads folder, Smartscreen warned, and upon ignoring the warning (choosing Run anyway), a pop-up alerted the file was missing, so Defender deleted it either before I could execute it or when I executed it.

EDIT

Interesting. I tried the download a second time just for kicks and giggles, and I noticed Windows security doesn't warn until I actually opened the Downloads folder (I waited about a minute after download completed), so I guess Defender scans upon file or file location access? After the warning, it also deleted the file.

 

[silversurfer]

0Patch has a patch for Windows "InstallerFileTakeOver" 0-day vulnerability, Microsoft has none​

There is a 0-day vulnerability for Windows, called InstallerFileTakeOver, which Microsoft has yet to address. The vulnerability was discovered by Abdelhamid Naceri, a security researcher, who discovered two other 0-day vulnerabilities in Windows this year already.

We mentioned the vulnerability in late November 2021 already here on this site. The issue was unpatched back then and Microsoft has yet to release a security update that addresses the vulnerability.

Micro-patching company 0Patch released a free patch for the issue this week that is available to all users. The micropatch that 0Patch released is available for the following operating systems:

• Windows 10 version 1709 to 21H1.
• Windows 7 ESU
• Windows Server 2012, 2012 R2, 2016, 2019.
• Windows Server 2008 R2 ESU

0Patch notes that non-ESU Windows 7 and Windows Server 2012 installations are not affected by the vulnerability. Windows Server 2022 and Windows 11 are likely also affected, but not officially supported by the company yet (hence no patch). Windows 8.1 was not analyzed because of low interest in the particular version of Windows.

0Patch has a patch for Windows "InstallerFileTakeOver" 0-day vulnerability, Microsoft has none - gHacks Tech News

Micro-patching company 0Patch released a free patch to patch the InstallerFileTakeOver vulnerability of Windows operating system.

www.ghacks.net

 

[LASER_oneXM]

Windows 'InstallerFileTakeOver' zero-day bug gets free micropatch

An unofficial patch is available for a zero-day vulnerability that is actively exploited in the wild to gain administrator privileges.

www.bleepingcomputer.com