Week of June 26, 2023

Security researcher lem0nSec published a proof-of-concept technique called ShellGhost that keeps shellcode encrypted in memory except for the currently executing instruction, evading memory scanners. The method uses vectored exception handling and software breakpoints to decrypt and execute one instruction at a time, then re-encrypt it, preventing the full shellcode from ever being exposed in plaintext. This allows malicious code to run undetected by tools like PE-Sieve and Moneta.

CVE-2023-35078 is a critical remote unauthenticated API access vulnerability in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core). It allows attackers to access personally identifiable information and create administrator accounts, leading to further system compromise. The vulnerability has been exploited in the wild, including in a zero-day attack against the Norwegian government, and patches are available.

A recent Cobalt Strike campaign uses a hardware breakpoint on the AMSI scan buffer to bypass antimalware scanning. The attack begins with a malicious LNK file that invokes PowerShell to download and execute a script, which sets a hardware breakpoint and registers an exception handler to manipulate AMSI results. This technique allows the final Cobalt Strike payload to execute without detection.

Researchers disclosed a new process injection technique named Mockingjay that bypasses EDR detection by leveraging legitimate DLLs that have pre-existing read-write-execute (RWX) memory sections. The method avoids suspicious Windows API calls like memory allocation or permission changes, instead injecting shellcode directly into the RWX section of a vulnerable DLL. This allows execution of malicious code in self-injection or remote process injection scenarios without triggering EDR hooks.

A vulnerability in Stormshield Endpoint Security Evolution versions 2.0.0 through 2.3.2 allows an interactive user to leverage the SES Evolution agent to create arbitrary files with local system privileges due to insecure permissions. This could lead to privilege escalation or system compromise on affected endpoints.