Week of September 4, 2023

Proofpoint disclosed CVE-2023-4801, an improper certificate validation vulnerability in the Insider Threat Management (ITM) Agent for macOS. An adjacent network attacker could perform a man-in-the-middle attack between the agent and the ITM server after registration. The vulnerability affects versions prior to 7.14.3.69 and has a CVSS score of 7.5 (High).

A proof-of-concept demonstrates that modifying a single byte in the kernel's PspNotifyEnableMask can disable core functions of AV/EDR solutions. The technique bypasses PatchGuard and affects endpoint protection by preventing security callbacks. The repository includes C code and references a commercial anti-malware product claiming to defend against this attack.

During a penetration test, a researcher bypassed a well-known EDR by using custom remote shells to evade pattern-based detection, obfuscating PowerShell to disable AMSI, and blocking EDR cloud communication via firewall/DNS changes. The EDR failed to detect credential gathering, lateral movement, and use of tools like Mimikatz after traffic was blocked.

CVE-2020-35593 is a local privilege escalation vulnerability in BMC PATROL Agent through version 20.08.00. A local attacker with low privileges can exploit the pconfig +RESTART -host command to gain elevated privileges, potentially domain admin. The vulnerability has a CVSS score of 7.8 and affects enterprise monitoring deployments.

Security researcher rasta-mouse released a Beacon Object File (BOF) that bypasses User Account Control (UAC) by authenticating to the Service Control Manager using Kerberos tickets. The tool is designed for use with Kerberos relay attacks and requires appropriate tickets to be present in the cache. It enables local privilege escalation on Windows endpoints.