jthuraisamy / telemetrysourcerer Goto Github PK

Issue 1

In IsProcessElevated():

• Leaks TokenHandle on exit
• Fails to call FreeSid on NtAuthority
• No checks for API failures. e.g. The return from GetTokenInformation is not checked, and with ElevationType being unintialized, it could be a random value on failure.

Issue 2a

In LoadDriver():

	WCHAR ExecutableDirectory[MAX_PATH] = { 0 };
-	GetModuleFileNameW(GetModuleHandle(NULL), (LPWSTR)&ExecutableDirectory, MAX_PATH * 2);  
+	GetModuleFileNameW(GetModuleHandle(NULL), (LPWSTR)&ExecutableDirectory, MAX_PATH - 1);  

Issue 2b

	WCHAR DriverPath[MAX_PATH] = { 0 };
-	StringCbPrintfW(DriverPath, MAX_PATH, LR"(\??\%ls\TelemetrySourcererDriver.sys)", ExecutableDirectory);
+	StringCchPrintfW(DriverPath, MAX_PATH, LR"(\??\%ls\TelemetrySourcererDriver.sys)", ExecutableDirectory);

Issue 2c

None of the exit paths free the obtained resources (SCM handles, driver handle)

	if (ServiceStarted)
		return ERROR_SUCCESS;
! fails to release resources
	else
		return GetLastError();
! fails to release resources

Issue 3

In GetCallbacks(std::vector<PCALLBACK_ENTRY> OldCallbackEntries):

Issue 4

In DriverEntry()

The driver object is created with default permissions that allow any user to open it. Since the driver exposes read/write primitives (IOCTL_GET_QWORD, IOCTL_SET_QWORD), this allows abuse and repurposing of this driver (esp if signed) to do anything (corrupt anything, read any secret). A redteam using this driver would weaken the security of a system beyond the scope of modifying telemetry.

The link for tips on creating a private lab leads to a page with a 401 error.

I was trying to access the post but it seems to have gone private. Is it still available elsewhere?

http://jackson-t.ca/edr-reversing-evading-03.html

Hi,

I tried the tool against below system and it is only showing me FileSystem Collection Type kernel callbacks. How do I see other callbacks like Thread Creation, Image Load etc

Host Name: xxxxxxx
OS Name: Microsoft Windows 10 Enterprise
OS Version: 10.0.19043 N/A Build 19043
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner: N/A
Registered Organization: N/A
Product ID: xxxxxxxx
Original Install Date: 23-09-2020, 16:38:44
System Boot Time: 01-07-2021, 15:34:22
System Manufacturer: LENOVO
System Model: xxxxxxx
System Type: x64-based PC
Processor(s): 1 Processor(s) Installed.
[01]: Intel64 Family 6 Model 142 Stepping 12 GenuineIntel ~801 Mhz
BIOS Version: LENOVO xxxxxx 01-07-2020

Regards
Pravesh