A new technique exploits the Windows 10 Microsoft Store wsreset tool and can bypass antivirus protection on a host computer without being detected.
Wsreset.exe is a legitimate troubleshooting tool that allows users to diagnose Windows Store problems and reset its cache.
Pentester and researcher Daniel Gebert discovered that wsreset.exe can be used to delete files arbitrarily.
As wsreset.exe runs with elevated privileges because it deals with Windows settings, this bug would allow attackers to delete files, even if they did not normally have the permissions.
Deleting files using wsreset.exe
When creating temporary cache and cookie files, Windows Store stores these files in the following directories:
After analyzing the wsreset utility, Gebert found that the tool will delete files present in these folders, thus resetting the cache and cookies for the Windows Store app.
The exploitation technique mentioned here is based on the simple concept of "folder junctions" that are similar.
If an attacker can create a link that points this path \InetCookies to a target directory of the attacker, the target directory will be the one that will be deleted when wsreset is run. This is because wsreset is run by default with elevated privileges.
To begin, the attacker first deletes the \INetCookies folder (which the wsreset utility would otherwise have deleted). Users with limited privileges can delete the folder, so this is not a challenge – either an attacker with control of a user account or a malicious script running under the compromised user's account can accomplish this.
After that, an attacker creates a link or a “folder junction', making the \INetCookies location point to a privileged location that would like to delete wsreset.exe.
In the example shown below, the attacker maps the \INetCookies directory to the location “C:\Windows\System32\drivers\etc”. The \etc folders contain important configuration files, including the “hosts” file for configuring local DNS rules.
“This can be done using mklink.exe with the '/J' parameter or via the PowerShell new-item command with the '-ItemType' parameter,” Gelbert explains in his blog post.
Now, when “wsreset” is executed by the attacker or their script, the “\etc” folder that would otherwise require elevated privilegeswill be deleted.
Abuse of wsreset to bypass antivirus
The researcher demonstrated how this behavior could be used to bypass antivirus, focusing on Adaware as an example.
“Adaware antivirus stores configuration files (and many others) in the folder ‘C:\ProgramData\adaware\adware antivirus’. Adaware antivirus needs these files to interact with previously downloaded malware signatures. Normal users cannot delete this folder,” Gelbert said.
After the attacker creates the symbolic link “\ INetCookies” to point to the “\ antaware antivirus” folder and executes wsreset, the files inside the folder are now deleted seamlessly.
Of course, some files (used by the antivirus program) may remain in the folder even after running wsreset, but that's not a problem. The overall process is enough to destroy the antivirus's functionality
After restarting the antivirus, it will be permanently disabled. This is because the settings and other essential files have been cleared from the system. And the antivirus could not detect or prevent it.
This privilege escalation vulnerability present in the wsreset.exe utility can be used for other purposes, such as UAC bypass, as demonstrated by Hashim Jawad in 2019.
