{"id":51915,"date":"2023-05-15T15:17:48","date_gmt":"2023-05-15T15:17:48","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/34618\/Not-Too-Safe-Boot-Remotely-Bypassing-Endpoint-Security-Solutions-And-Anti-Tampering-Mechanisms.html"},"modified":"2023-05-15T15:17:48","modified_gmt":"2023-05-15T15:17:48","slug":"not-too-safe-boot-remotely-bypassing-endpoint-security-solutions-and-anti-tampering-mechanisms","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/not-too-safe-boot-remotely-bypassing-endpoint-security-solutions-and-anti-tampering-mechanisms\/","title":{"rendered":"Not-Too-Safe Boot: Remotely Bypassing Endpoint Security Solutions And Anti-Tampering Mechanisms"},"content":{"rendered":"

Introduction<\/strong><\/p>\n

In this article, we provide an in-depth analysis of the Not-Too-Safe Boot<\/em> technique, which has been designed to bypass Endpoint Security Solutions like antivirus (AV), endpoint detection and response (EDR) and anti-tampering mechanisms remotely.<\/p>\n

This method builds on a local execution technique first published in 2007 and later utilized in a real world scenario by a ransomware in 2019. <\/p>\n

By leveraging native Windows functionalities, Not-Too-Safe Boot<\/em> is a review of the original technique (that was used only locally) that enables attackers, with administrative privileges over the victim system, to remotely force to boot in safe mode and carry out malicious activities.<\/p>\n

<\/span> <\/p>\n

Background<\/strong><\/p>\n

The original method, to the best of our knowledge, was first documented in the paper \u201cWin32\/Bypass Abstract<\/a>\u201d published on PacketStorm more than 15 years ago.<\/p>\n

As comented above, in 2019, a real world ransomware, the Snatch ransomware used a variant of this technique to bypass security measures, as reported by Sophos<\/a>.<\/p>\n

In response to the ever-changing threat landscape, the Not-Too-Safe Boot<\/em> technique was developed to further exploit these weaknesses remotely.<\/p>\n

Not-Too-Safe Boot: The Basics.<\/strong><\/p>\n

Not-Too-Safe Boot<\/em> is a remote technique that leverages native Windows functionalities, making it 100% Living-off-the-Land (LotL). <\/p>\n

It enables an attacker with administrative privileges to remotely force a system to start in safe mode, thereby disabling any AV, EDR or another cybersecurity solutions with antitampering mechanism and allowing them to perform various malicious actions.<\/p>\n

Not-Too-Safe Boot: Attack Execution.<\/strong><\/p>\n

The following are the steps to implement the attack:<\/p>\n

1. <\/em><\/strong>Enable \u201cremote registry\u201d service<\/strong>:<\/em> To initiate the attack, the remote registry service must be enabled, allowing changes to the target system\u2019s registry remotely. <\/p>\n

2.<\/strong> Force write permissions on the BCD00000000 registry branch<\/strong>:<\/em> The attacker must modify the permissions of the BCD00000000 registry branch to enable write access. This step is critical, as it allows the attacker to manipulate the target system\u2019s boot configuration data. <\/p>\n

3. Remotely write the necessary registry entries<\/strong>:<\/em> With write access to the BCD00000000 registry branch, the attacker can remotely create registry entries to force the system to boot in \u201csafeboot with network\u201d mode in the branch. This mode allows the attacker to maintain network connectivity during the attack while disabling AV and EDR solutions. <\/p>\n

4. <\/em><\/strong>Initiate a system reboot<\/strong>:<\/em> The attacker initiates a system reboot, which forces the target system to start in safe mode with the modified boot configuration. <\/p>\n

5. <\/em><\/strong>Gain remote access and execute commands<\/strong>:<\/em> Once the system reboots in safe mode, the attacker can use Windows Management Instrumentation (WMI) and the \u201cprocess call create\u201d method to remotely execute commands on the now unprotected system.<\/p>\n

Not-Too-Safe Boot: In-Deep Key Fact<\/strong><\/p>\n

In order to modify BCD00000000<\/strong><\/em> and write to the registry remotely the HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurePipeServers\\winreg<\/em> orquestates who has enough privileges to perform this actions. This registry key has two different aproaches.<\/p>\n

1. The ACL\/ACE of this registry key defines which user\/groups can manage remotely the registry:<\/p>\n