Conversation

Need local admin and have physical access? - Plug a Razer mouse (or the dongle) - Windows Update will download and execute RazerInstaller as SYSTEM - Abuse elevated Explorer to open Powershell with Shift+Right click Tried contacting

@Razer

, but no answers. So here's a freebie

1:23

445.7K views

11:55 AM · Aug 21, 2021Twitter Web App

Replying to

and

streamable.com/q2dsji for better quality poc video

497

jonhat

@j0nh4t

Aug 21, 2021

Additionally if you go through the installation process and define the save dir to user controllable path like Desktop. A service binary is saved there which can be hijacked for persistance and is executed before user logon on boot.

707

jonhat

@j0nh4t

Aug 22, 2021

I would like to update that I have been reached out by

@Razer

and ensured that their security team is working on a fix ASAP. Their manner of communication has been professional and I have even been offered a bounty even though publicly disclosing this issue.

1,152

Replying to

and

Love this. Have you tried if it's possible to trigger razerinstaller w/o a razor mouse by spoofing the usb vendor/product id?

102

jonhat

@j0nh4t

Aug 21, 2021

This is a bit out of my comfort zone so idk, I dont see why not unless there are signatures involved. I did try it over RDP (RemoteFX enabled) and was able to trigger the installer, but the session is different from a local one so won't show the window :(

103

Show replies

Replying to

and

Yeah unfortunately many devices trigger downloaders via Windows Update. I think this happened to me with a Logitech webcam once, and I immediately wondered if this could be done, but I was lazy.

Smaxx

@TheSmaxx

Aug 22, 2021

The problem isn't the installer itself. It's the installer running as System *and* providing a common file dialog to escape from.

Replying to

and

Think of the attack surface of EVERY SINGLE device driver on Windows Update that is triggerable via a USB connection. All you need is a single one with a vulnerability. Physical access (or RemoteFX via RDP) is a dangerous thing indeed...