Maxthon Browser Vulnerability Can Help Attackers in Post-Exploitation Phase

guest · Oct 23, 2019

Maxthon Browser Vulnerability Can Help Attackers in Post-Exploitation Phase
October 23, 2019
https://www.securityweek.com/maxtho...ty-can-help-attackers-post-exploitation-phase

The vulnerability was discovered by researchers at SafeBreach Labs, and has been designated the reference CVE-2019-16647. Exploitation requires administrator privileges, but post exploitation it can be used to achieve privilege escalation, persistence and in some cases defense evasion.
SafeBreach has reported the vulnerability to Maxthon, who has confirmed receipt and provided a timeline for a fix. Neither the timeline nor confirmation that the fix is effective have been published.

The vulnerability occurs because part of the Maxthon software -- including MxService.exe -- runs as 'NT AUTHORITY\SYSTEM', giving it powerful permissions and capabilities. It is signed by Maxthon Technology Co, Ltd, so any malicious payload executed by MxService gets an application whitelisting bypass. And it starts automatically on system boot, providing a persistence mechanism.

It is a simple coding error that should be easily fixable.
Click to expand...

Without being fixed, however, a malicious payload gains persistence by being loaded every time the browser is restarted.

"This way," warn the researchers, "the malicious payload might not be detected by security products, because the service process which executes the attacker’s payload is signed, and executes it 'natively'. No suspicious action is required by the attacker. The serviceit just executes the malicious executable once it is started."
Click to expand...

Rasheed187 · Oct 26, 2019

Why the hell is Maxthon running as a system service? This browser is shady as hell, can't believe it's still this popular.

guest · Oct 27, 2019

Perhaps it is a service for auto-updating of Maxthon.

Rasheed187 · Nov 3, 2019

mood said: ↑

Perhaps it is a service for auto-updating of Maxthon.
Click to expand...

Well, no matter what the purpose is, it's still a stupid idea.

Log in or Sign up

Maxthon Browser Vulnerability Can Help Attackers in Post-Exploitation Phase

guest Guest

Rasheed187 Registered Member

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Maxthon Browser Vulnerability Can Help Attackers in Post-Exploitation Phase

guest Guest

Rasheed187 Registered Member

guest Guest

Rasheed187 Registered Member

Useful Searches