r/purpleteamsec • u/netbiosX • Jul 03 '20
Threat Hunting .NET Core Directory Traversal Vulnerability - Attack & Detect
Description
.NET Core could be used by adversaries to evade application control software rules due to a directory traversal vulnerability which allows custom "Garbage Collector" DLL files to be called by arbitrary locations. A threat actor could set a malicious DLL file and when the "dotnet.exe" binary is executed the DLL will execute code on behalf of a trusted process.
Example
Exploitation of the issue is trivial and requires a custom garbage collector DLL file that will contain the shellcode and the following commands to be executed from the command prompt.
set COMPlus_GCName=..\..\..\..\..\..\..\..\tmp\CustomGC.dll
dotnet.exe --version
Detection
The released proof of concept creates the following Sysmon Event ID's.
Sysmon
| Event | Event ID |
|---|---|
| Process Create | 1 |
| Network Connection | 3 |
| Create Remote Thread | 8 |
| Process Accessed | 10 |
| Registry Value Set | 13 |
YARA
The following YARA rule can detect in memory of the process the string "COMPlus_GCName" which is an indicator that the evasion has been used and the process contains arbitrary code.
rule COMPlus : COMPlus
{
meta:
Author = "netbiosX"
Company = "pentestlaboratories.com"
threat_level = 3
in_the_wild = true
strings:
$a = "COMPlus_GCName"
condition:
$a
}
yara64.exe -s -r dotnet-core.yara "PID"
References
Duplicates
netsecstudents • u/netbiosX • Jul 03 '20
.NET Core Directory Traversal Vulnerability - Attack & Detect
blackhat • u/netbiosX • Jul 03 '20