Week of July 29, 2024

RustPatchlessCLRLoader is a proof-of-concept tool that loads .NET assemblies while bypassing AMSI and ETW using hardware breakpoints instead of memory patching. It was tested against several EDR products and successfully executed without detection, though behavioral detection may still trigger on malicious actions.

A remote code execution vulnerability exists in the shadowing component of Netwrix CoSoSys Endpoint Protector (through 5.9.3) and Unify (through 7.0.6) agents. An attacker with administrative access to the management server can overwrite sensitive configuration and execute system commands with SYSTEM/root privileges on a client endpoint. This allows complete compromise of endpoints managed by the affected products.

Team82 discovered a vulnerability (CVE-2024-6242) in Rockwell Automation ControlLogix 1756 devices that allows bypassing the trusted slot security feature. An attacker with network access can use CIP routing to traverse the backplane and send elevated commands to the PLC CPU from an untrusted network card. Rockwell has issued a fix, and CISA published an advisory.

A local privilege escalation vulnerability (CVE-2024-0353) in ESET Smart Security Premium allows a standard user to delete arbitrary files as SYSTEM by exploiting a time-of-check-to-time-of-use (TOCTOU) race condition in the real-time protection feature. The attack leverages NTFS alternate data streams to keep a directory empty during file scanning, then creates a junction to redirect a delete operation to a protected directory like C:\Config.msi. This technique, introduced by researcher Abdelhamid Naceri, bypasses assumptions about directory emptiness and can potentially affect other security products.

Microsoft disclosed that multiple ransomware gangs are actively exploiting CVE-2024-37085, an authentication bypass vulnerability in VMware ESXi hypervisors. The flaw allows attackers with Active Directory permissions to gain full administrative access to ESXi hosts, leading to ransomware deployment. VMware has released patches and mitigations.