TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Proof of concept WMI virus (zero-day)

69 点作者 alberto-m3 个月前

8 条评论

kachapopopow3 个月前
Ah, good to know that there&#x27;s people still making a complete mockery of windows even now.<p>Do note that VBS mitigates a majority of &#x27;buffer overflow&#x27; exploits and Microsoft has historically shown to brush off these vulnerabilities so that 100k bounty is pretty far fetched.<p>Any WMI operation does touch the disk (because it&#x27;s a database), but similar to any kind of other database they&#x27;re mixed with writes that happen in a normal environment and are not really possible to tell between malicious applications.<p>WMI requires administrator privileges to write so the privilege escalation is not that interesting except in limited environments (and Microsoft has also shown in the past that they don&#x27;t care about these), which is fair considering you can&#x27;t call &#x27;sudo&#x27; a security vulnerability.
评论 #42866363 未加载
alberto-m3 个月前
From a Reddit comment [1]: “the repo contains two novel and different ways to run any process as the SYSTEM user. It also disables every antivirus through a novel process privilege deescalation exploit”<p>[1] <a href="https:&#x2F;&#x2F;old.reddit.com&#x2F;r&#x2F;ReverseEngineering&#x2F;comments&#x2F;1icgfua&#x2F;got_bored_reversed_the_wmi_made_a_novel_virus&#x2F;" rel="nofollow">https:&#x2F;&#x2F;old.reddit.com&#x2F;r&#x2F;ReverseEngineering&#x2F;comments&#x2F;1icgfua...</a>
评论 #42866029 未加载
评论 #42866019 未加载
Almondsetat3 个月前
Quoting the README: &quot;The WMI is an extension of the Windows Driver Model. It&#x27;s a CIM interface that provides all kinds of information about the system hardware, and provides for a lot of the core functionality in Windows. For example, when you create a startup registry key for an an application, that&#x27;s really acting on the WMI at boot.&quot;
EvanAnderson3 个月前
Persistence inside the WMI database is fun. There was a good talk about this at DerbyCon[0] years ago. I think it has gotten more press since several APT groups were using it but it still isn&#x27;t a well-known persistence mechanism.<p>[0] <a href="https:&#x2F;&#x2F;www.irongeek.com&#x2F;i.php?page=videos&#x2F;derbycon5&#x2F;break-me12-whymi-so-sexy-wmi-attacks-real-time-defense-and-advanced-forensic-analysis-matt-graeber-willi-ballenthin-claudiu-teodorescu" rel="nofollow">https:&#x2F;&#x2F;www.irongeek.com&#x2F;i.php?page=videos&#x2F;derbycon5&#x2F;break-m...</a>
ComputerGuru3 个月前
The real value in this: a new way to more easily disable Windows Defender on Windows 11.
jolfosh3 个月前
The fact that so many critical infrastructure systems still depend on Windows is absurd (I say from my Windows machine). Great find! Thank you for sharing.
ptx3 个月前
So where is the data actually stored if it &quot;never touches the disk&quot;? Is it some UEFI or BIOS thing?
NetOpWibby3 个月前
I wonder why this person didn’t submit this to Microsoft for a billion dollars.
评论 #42868477 未加载