! Positive Technologies (PT Expert Security Center). , « » PT Sandbox .
. , , UAC , , PT Sandbox. .
— . . , . , .
, — , LSA (Local Security Authority) , , . explorer.exe, . , , , , . EPROCESS, OC Windows, . , .
, , , , - . : - → → API — ImpersonateLoggedOnUser, → .
, syscall NtOpenProcessToken. , , — , , DesiredAccess . , ProcessHandle 0xFFFF… ( 32- , F 64- ).
ImpersonateLoggedOnUser, , , : NtQueryInformationToken, NtDuplicateToken , NtSetInformationThread . .
, , , .
, CreateProcessWithTokenW advapi32. NdrClientCall4, : .
№ 1: → ( — , — ) → , Secondary logon service.
№ 2: , — 0.
— . rpcmon.
, , : « NdrClientCall4?» , — . , 32- 64- , NdrClientCall4. 64- , NdrClientCall3.
, , advapi32!LogonUserA/W . , , , . , NdrClientCall4, SspirLogonUser, .
PT Sandbox?
« » « » . , Write.Thread.Token.Impersonation, Create.Process.WithToken. Impersonation, Create.Token.LogonUser.Impersonation .
UAC: ,
, , . User Account Control — , , , , , . UAC , , , .
, UAC, . :
autoElevate, True;
;
.
, , UAC: , system32 50 . UAC.
Wusa
, . Wusa, /extract → → DLL extract → , .
, DLL, . , Windows 10 Wusa extract.
UAC , — , . Fodhelper — Windows 10, . , , . , , fodhelper .
( ). .
, , . , , . , windir, ( ), . — , .
COM-
OM- — Windows, . , , , UAC.
IFileOperation, , — , COM-. → IFileOperation → system32 → sysprep.exe, → DLL. , DLL, . , .
, COM- — , , dllhost.exe.
Shim-
: , . shim- — .
, : , . :
Windows — , API. , windows , «windows\system32».
.
DLL .
DLL.
, «» , . : , , - .
PT Sandbox?
Create.Process.ExtraRegKey.UACBypass, Create.Process.EnvironmentVar.UACBypass, Create.Process.DirectoryMock.UACBypass, Create.Process.COMDLLHijack.UACBypass .
PT Sandbox 2020 , Polpo UAC, — .
2015 APT28 CVE-2015-1701 ( zero day) . - MD5 .
: CreateWindowExW , kernel_steal_token.
API- CreateWindowsExW, hooked_ClientCopyImage. SetWindowLogPtrW, — , — – 4 — , . , , , .
PsLookupProcessByProcessId → , — EPROCESS → → , , . , .
CVE-2015-1701 PT Sandbox: .
PsLookupProcessByProcessId?
, PsLookupProcessByProcessId . ?
NtQuerySystemInformation SystemInformationClass, 11. () . OC — .
→ PsLookupProcessByProcessId ( ) → → «» ( ) → .
, , 2011 FIN6 , . , , — HalDispatchTable. , , , 4- , , syscall , .
. , Fancy Bear 2016 zero day.
APT FruityArmor .
PT Sandbox? OC . (, .)
, PT Sandbox , . , .
PT Sandbox
PT Sandbox — . ( ). — , . , , , , . PT Sandbox .
, , , . PT Expert Security Center — .
:
PT ESC
PT ESC