From the same author as BlueHammer we now have RedSun.

[astraleureka@social.treehouse.systems]

@wdormann Does it still depend on VSS and the cloud storage filter subsystem?

[wdormann@infosec.exchange]

From the GitHub repo:

When Windows Defender realizes that a malicious file has a cloud tag, for whatever stupid and hilarious reason, the antivirus that's supposed to protect decides that it is a good idea to just rewrite the file it found again to it's original location.

This Exploit uses the "Cloud Files API", writes EICAR to a file using it, uses an oplock to win a volume shadow copy race, and uses a directory junction/reparse point to redirect the file rewrite (with new contents) to C:\Windows\system32\TieringEngineService.exe. At this point, the Cloud Files Infrastructure runs TieringEngineService.exe as SYSTEM. Game over.

[wdormann@infosec.exchange]

@astraleureka
Yes it uses both.

[kkarhan@jorts.horse]

@wdormann so basically a "#cloud-based #utilman-style "privilegue escalation"?
https://www.youtube.com/watch?v=X_9OuDjl97M

[kkarhan@jorts.horse]

@wdormann I can't wait for this to get #BadUSB'd like #PoisonTap!

- YouTube

Auf YouTube findest du die angesagtesten Videos und Tracks. Außerdem kannst du eigene Inhalte hochladen und mit Freunden oder gleich der ganzen Welt teilen.

(www.youtube.com)

[kkarhan@jorts.horse]

@wdormann ...or like #PwnPiALOA.
https://www.youtube.com/watch?v=s0K-YIL_G5c

#P4wnP1 #PwnPi #P4wnP1ALOA #ALOA

[astraleureka@social.treehouse.systems]

@wdormann Just finished reading through the source, thank you. Much simpler than the first version, and makes the root issue a lot more clear. This is pretty nasty, MS has some serious egg on their faces over this one

[xc3ll@mastodon.social]

@wdormann

[christopherkunz@chaos.social]

@wdormann Hey, just so I can learn this: How do I compile RedSun.cpp under Win32 with VS or gcc? I can't seem to include cfapi.h correctly (I have the full win32 sdk under the default location).

[wdormann@infosec.exchange]

@christopherkunz
TBH, for code that doesn't include a .SLN file, I usually have minimal luck compiling it straight-up with cl.exe

In this case, I simply made a new Visual Studio 2022 project for a console app, and then replaced the .CPP file contents with what's in the GitHub repo. There are a slew of warnings, but it compiles.

<snip>
1>C:\Users\test\source\repos\test\test\test.cpp(431,11): warning C4267: 'initializing': conversion from 'size_t' to 'int', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(694,49): warning C4267: '=': conversion from 'size_t' to 'ULONG', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(696,92): warning C4267: 'argument': conversion from 'size_t' to 'ULONG', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(714,20): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(736,57): warning C4838: conversion from 'LONG' to 'DWORD' requires a narrowing conversion
1>Generating code
1>Previous IPDB not found, fall back to full compilation.
1>All 27 functions were compiled because no usable IPDB/IOBJ from previous compilation was found.
1>Finished generating code
1>test.vcxproj -> C:\Users\test\source\repos\test\x64\Release\test.exe
1>Done building project "test.vcxproj".
========== Build: 1 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========
========== Build completed at 8:43 AM and took 01.818 seconds ==========

[christopherkunz@chaos.social]

@wdormann Yeah, this worked fine. As did the exploit. Thanks for your help! (And for anyone else reading this, the keyboard shortcut to "just compile, don't run" is ctrl-shift-b)

[qdkp@cyberplace.social]

@wdormann Thank you. Blocking cldapi.dll using AppLocker works though that will break OneDrive and stuff like that.

[wdormann@infosec.exchange]

@qdkp
People don't use OneDrive intentionally, do they?

[qdkp@cyberplace.social]

@wdormann

[wdormann@infosec.exchange]

Interestingly, a good chunk of the [(12/73) AV detections on VT](https://www.virustotal.com/gui/file/d84250e2ad053ab4097d0591933935573e4cab3e975360004a126abc102dc6f6 for this RedSun.exe exploit are due to the EICAR part being detected, despite the string being reversed in the code. (note: this reversal apparently does nothing to prevent EICAR detection in the AV engines on VT)

If we make the EICAR string less obvious (encrypted), the detections drop to 5.

Defender currently doesn't detect the exploit in either case.