Week of May 27, 2024

A zero-day path-traversal vulnerability in Check Point Quantum network security devices was actively exploited starting around April 30, 2024, allowing remote attackers to obtain sensitive credentials and gain network access. The flaw is described as 'extremely easy' to exploit and affects the very devices designed to protect corporate networks. Check Point has released patches and urged customers to apply them.

A GitHub project named 'No Defender' demonstrates a method to disable Microsoft Defender and firewall by abusing the undocumented Windows Security Center (WSC) API. The tool repurposes a signed Avast component to register a null antivirus product, causing Defender to deactivate. It requires administrative privileges and has implications for both legitimate security testing and potential malicious use.

Security researchers at dotSec documented a practical method to bypass Microsoft Defender detection for the SharpC2 .NET drone executable. By applying rename-only obfuscation with ConfuserEx2 to the drone.dll and excluding reflection-dependent classes, they achieved a functional bypass of static signatures like BluntC2 and Wacatac ML. The technique highlights the importance of entropy management and minimal evasive features when testing endpoint detection.

A buffer overflow vulnerability in Ivanti Endpoint Manager (EPM) up to version 2021.1 SU5 allows local privilege escalation. The flaw resides in the issuser.exe component, where a user-controlled size field in a network packet leads to an unbounded strncpy into a fixed-size buffer in the .data segment. Exploitation can overwrite a function pointer used by the C++ exception handler, enabling arbitrary code execution.

Dsebler is a reimplementation of the KExecDD technique to bypass Driver Signature Enforcement (DSE) on Windows by exploiting the KsecDD kernel module. It allows arbitrary kernel memory write via IOCTL 0x39006f, disabling DSE to load unsigned drivers. This demonstrates a method to undermine a key Windows security feature.

A security researcher demonstrated a bypass of Microsoft Entra ID's token protection conditional access policy by spoofing the device type during a device code phishing attack. The technique allows an attacker to obtain a valid bearer token and access cloud resources like email, despite token protection being enabled. The bypass highlights that token protection alone is insufficient against external token theft.

A local privilege escalation vulnerability in Zscaler Client Connector allows a standard user to execute arbitrary commands as NT AUTHORITY\SYSTEM by bypassing RPC caller validation. The issue stems from a cache that stores allowed process IDs without pruning, enabling an attacker to brute-force a cached PID and make unauthorized RPC calls. This was chained with other bugs to achieve zero-interaction privilege escalation.