## What Happened?

Security researcher Abdelhamid Naceri discovered a privilege escalation vulnerability in Microsoft Windows that can give admin rights to threat actors.

The vulnerability was discovered when Microsoft released a patch for CVE-2021-41379 (Windows Installer Elevation of Privilege Vulnerability) as a part of the November 2021 Patch Tuesday. Naceri found a bypass to the patch, as well as a more severe zero-day privilege escalation vulnerability, and [published a proof-of-concept exploit ](https://github.com/klinix5/InstallerFileTakeOver)for the zero-day on GitHub.

This zero-day vulnerability affects all supported client and server versions of Windows, including Windows 10, Windows 11 and Windows Server — even with the latest patches.

## How Bad is This?

Pretty bad; privilege elevation is a serious situation, especially when threat actors could elevate from user to admin rights. Throughout 2021 we have seen a growing number of privilege escalation vulnerabilities land on Windows, which is only increasing the attack surface in environments at this point.

There are no workarounds currently available, according to Naceri. Due to the fact that this vulnerability and exploit leverage existing MSI functionality, it is difficult to inherently workaround.

The good news is that a threat actor would need local access to the machine to take advantage of this vulnerability. More good news is that Windows Defender detects the PoC.

## What Should I Do?

Organizations that haven’t already [enabled Sysmon](https://www.blumira.com/enable-sysmon/) in their environment should do so. Blumira’s newly-created PowerShell script, [Poshim](https://www.blumira.com/integration/poshim-automate-windows-log-collection/), streamlines Windows log collection by automatically installing and configuring NXLog and Sysmon to ship logs over Sysmon to a targeted IP.

Although there are no workarounds, admins can use an endpoint solution and a security incident and event management (SIEM) platform to detect for signs of the PoC exploit in an environment.

## How To Detect

This PoC code is easily detectable in its current form due to a built-in MSI (or installer package) and the fact that the PoC has a number of hard-coded naming conventions.

Blumira security experts tested the exploit in their lab environment and found a few ways to detect the PoC:


With Sysmon enabled, admins can look for the following behaviors:

windows_event_id = 11
AND target LIKE ‘%microsoft plz%’

By default the PoC [utilizes a target with “microsoft plz”](https://github.com/klinix5/InstallerFileTakeOver/blob/0998671bca5d9c8b64093bc220aa7a8554d22eb5/InstallerFileTakeOver/InstallerFileTakeOver.cpp#L150) in the path, this allows for quick detection opportunities for lazy attackers.


process_name = ‘C:\Windows\system32\msiexec.exe’
AND target LIKE ‘%AppData%splwow64.exe’
AND windows_event_id in (11,26)

The second Sysmon detection uses splwow64.exe in its own AppData folder, which it creates and deletes during the process.

**Windows logs**

Admins can look for the following Windows logs in Event Log Viewer:

AND message LIKE ‘%test pkg%’

Application logs that contain hardcoded test pkg similar to “microsoft plz” above. Attackers building their own exploits will not utilize this naming convention however.


REGEXP_CONTAINS(message, r’Users.*AppData\Local\Temp\2\{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}}.msi’)
AND user_id=’S-1-5-18′
AND windows_event_id=1042

The System’s Application log as system references the initial User’s appdata with the System user and SID (S-1-5-18) and user on a failed MSI install. So far in our testing we were able to reduce false positives but looking for a specific UUID4 format due to how this MSI installer activates but this may result in noise at times.

Final stage of attack shows the completion of the installer transaction as SYSTEM with a reference to the initializing user.

**Application Eventlog**

Search for EventID 1033 and the keyword ‘test pkg’

We will update this post as we find out more information. We’re also hosting [a livestream at 3:30 PM ET](https://www.blumira.com/webinar/mitigate-windows-vulnerabilities/) to answer any questions and give updates.

[*This was originally published on Blumira’s blog.*](https://www.blumira.com/windows-zero-day-admin-rights/)

Share This Discussion

Leave a Comment

Note: By filling this form and submitting your commen, you acknowledge, agree and comply with our terms of service. In addition you acknowledge that you are willingly sharing your email address with AiOWikis and you might receive notification emails from AiOWikis for comment notifications. AiOWiksi guarantees that your email address WILL NOT be used for advertisement or email marketting purposes.

This site uses Akismet to reduce spam. Learn how your comment data is processed.