CheckMAL AppCheck Pro Improper Reparse Point Handling Leading to Arbitrary File Write and DLL Planting for SYSTEM Privilege Escalation
CheckMAL AppCheck Pro provides a ransomware protection feature called RansomShelter, which automatically backs up original files to a protected storage location when file modifications are detected.
This mechanism is implemented using a virtualized file system based on the Windows NT Device namespace (\Device\HarddiskVolumeX), which emulates the structure of the C:\ drive.
However, this virtual file system does not validate or restrict Windows Reparse Points (junctions, symbolic links, or mount points). In addition, the RansomShelter storage directory is exposed with Everyone Full Control permissions.
As a result, a low-privileged user can create a junction within the RansomShelter path and redirect it to a protected system directory. When the AppCheck kernel mini-filter driver (AppCheckD.sys) performs file backup operations, it follows the attacker-controlled reparse point and creates files in protected locations with SYSTEM privileges.
Furthermore, AppCheck-related services and processes load DLLs from their installation directory with high priority, as confirmed by Process Monitor captures. By planting a malicious proxy DLL into the AppCheck installation directory, an attacker can achieve arbitrary code execution as SYSTEM.
AppCheckD.sys (Kernel Mini-Filter Driver)