ShieldBreak Exploit: Local Privilege Escalation via Windows Error Reporting

The ShieldBreak exploit facilitates local privilege escalation on Windows systems by subverting the Windows Error Reporting (WER) mechanism. An attacker triggers the 'QueueReporting' scheduled task, which invokes WerMgr.exe. Through a vulnerability in how the service handles library loading, the exploit forces WerMgr.exe to load an attacker-controlled phantom DLL named 'phoneinfo.dll'. Once the library is loaded, the process is coerced into spawning a child process that inherits SYSTEM integrity level. This technique, identified as part of the broader 'RoguePlanet' threat landscape, allows low-privileged users to achieve full system compromise. The vulnerability is highly significant for defenders as it bypasses standard user access controls, enabling persistent access and elevated execution by exploiting a core Windows utility.

Attack Chain

1. The attacker gains initial access to the target system as a low-privileged user.
2. The attacker identifies or creates a directory where they have write permissions to place the malicious phantom DLL.
3. The attacker drops 'phoneinfo.dll' into a path where WerMgr.exe is expected to search for dependencies during its execution phase.
4. The attacker triggers the legitimate 'QueueReporting' scheduled task to execute WerMgr.exe manually or forced via command-line arguments.
5. WerMgr.exe initiates the error reporting workflow and performs a search for the required DLLs.
6. The application loads the attacker-planted 'phoneinfo.dll' into the context of the elevated WerMgr.exe process.
7. The malicious code within the DLL executes, spawning a child process (such as a command shell).
8. The child process inherits the SYSTEM integrity level, granting the attacker unrestricted system access.

Impact

Successful exploitation results in full local privilege escalation, allowing attackers to perform any action with SYSTEM privileges. This includes dumping credentials, installing persistence mechanisms, and disabling security software. The activity has been associated with the 'RoguePlanet' threat actor activities, potentially impacting any Windows workstation or server where an attacker has achieved initial low-privileged access.

Recommendation

• Deploy the Sigma rule below to detect WerMgr.exe spawning processes with SYSTEM integrity or by system-owned accounts.
• Enable Sysmon Event ID 1 (Process Creation) and ensure command-line and parent process path logging is enabled.
• Monitor scheduled task executions for 'QueueReporting' combined with unexpected file system modifications in directories prone to DLL hijacking.
• Restrict write access to sensitive system directories to prevent the dropping of malicious DLLs.