Windows Zero-day  - 1Hfeq1555391893 - Windows Zero-day Lets Hackers Take Complete Control of the Windows

Very recently patched Windows zero-day vulnerability (CVE-2019-0859) in win32k.sys let hackers take control of unpatched Windows systems.

researchers from Kaspersky team recent addressed this Zero-day vulnerability in win32k.sys while it made an attempt to exploit one of their customers Microsoft Windows operating system.

A Local Privilege Escalation vulnerability was then reported later to Microsoft and released a patch for Zero-day along with 74 other security .

This is actually the fifth vulnerability that consecutive exploited Local Privilege Escalation vulnerability in Windows that uncovered by Kaspersky team researchers, here the previous zero-days in very recent past.

Zero-day Exploit Process in Windows win32k.sys

This Vulnerability is presented in the CreateWindowEx, a function that
creates an overlapped, pop-up, or child window with an extended style.

Attackers Exploiting this elevation of privilege vulnerability in Windows when Win32k component fails to properly handle objects in memory.

A PowerShell script mainly used by attackers for the post-exploitation process with a Base64 encoded command. 

The ultimate goal of this PowerShell script to download a second-stage script from https//pastebin.com.

This Second stage of the PowerShell executes the final stage which is also a PowerShell Script that you can see in below image.

Windows Zero-day  - powershell script - Windows Zero-day Lets Hackers Take Complete Control of the Windows
Third stage PowerShell script

According to Kaspersky, the third script is very simple and does the following:

  • Unpacks shellcode
  • Allocates executable memory
  • Copies shellcode to the allocated memory
  • Calls CreateThread to execute shellcode

At the final stage, the shellcode is to make a trivial HTTP reverse shell that leads to attackers gain complete control of the targeted victims Windows system.

Download Free E-book to about complete Enterprise Security Implementation & Mitigation Steps – Download Free-Ebook Here.

You can follow us on LinkedinTwitterFacebook for daily updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:

Microsoft Hacked – Hackers Compromised The Microsoft Employee’s Account to Gain Access the Customers Email

Unpatched Internet Explorer Zero-day Vulnerability Lets Attackers Hack Windows PC & Steal Files





Source link
Based Blockchain Network

No tags for this post.

LEAVE A REPLY

Please enter your comment!
Please enter your name here