Oct 31, 2024, 01:47 PM
A recently discovered vulnerability, CVE-2024-0311 (also known as SB10418), allows a malicious insider to bypass the existing policies of the Skyhigh Client Proxy without requiring a valid release code. This PoC highlights an advanced injection technique into SCPBypass.exe, facilitating unauthorized access through SCPService.exe via an exploitable pipe mechanism.
Vulnerability Summary:
The PoC demonstrates how a malicious insider could leverage an RW-accessible pipe, \\.\pipe\MCPTrayPipe0, managed by SCPService.exe. Though this pipe is RW-accessible by default, access control checks performed by WGUARDNT limit writing to authorized processes. The bypass is achieved by injecting into a user-ran instance of SCPBypass.exe, satisfying the check and allowing unauthorized data to be written to the service pipe.
Technical Breakdown
The injection mechanism circumvents Trellix/McAfee LoadLibrary protections by executing shellcode directly on the pipe using WriteFile. This shellcode is designed to bypass common AV and EDR hooks that typically block unauthorized LoadLibrary calls.
Key elements:
Github Link:
Vulnerability Summary:
The PoC demonstrates how a malicious insider could leverage an RW-accessible pipe, \\.\pipe\MCPTrayPipe0, managed by SCPService.exe. Though this pipe is RW-accessible by default, access control checks performed by WGUARDNT limit writing to authorized processes. The bypass is achieved by injecting into a user-ran instance of SCPBypass.exe, satisfying the check and allowing unauthorized data to be written to the service pipe.
Technical Breakdown
The injection mechanism circumvents Trellix/McAfee LoadLibrary protections by executing shellcode directly on the pipe using WriteFile. This shellcode is designed to bypass common AV and EDR hooks that typically block unauthorized LoadLibrary calls.
Key elements:
- Injection Target: SCPBypass.exe process.
- Vulnerable Pipe: \\.\pipe\MCPTrayPipe0.
- AV/EDR Bypass: Custom shellcode bypasses McAfee hooks on LoadLibrary.
Github Link:
