Vipere: One-Click Hijack of Visual Studio Installer Service for Stable SYSTEM Privilege Escalation

Tool Overview

Vipere is a Beacon Object File (BOF) module for Cobalt Strike and Adaptix that hijacks the Visual Studio Installer Elevation Service (VSInstallerElevationService) to obtain SYSTEM privileges and achieve persistence without replacing any Microsoft‑signed binaries. The beacon runs inside the signed process, ETW is disabled, and EDR solutions see no anomalous activity.

Attack Chain – Three Non‑Vulnerable Weaknesses

Weakness 1 – Lax SDDL permissions

The service’s start‑up ACL grants Authenticated Users the SERVICE_START right. Any ordinary user can execute sc start VSInstallerElevationService, causing the service to run as SYSTEM. The service registry entry remains after Visual Studio is uninstalled.

Weakness 2 – .NET CLR does not verify AppDomainManager assembly signature

The CLR loads the assembly specified in the <appDomainManagerAssembly> element of the service’s .config file without checking a Microsoft signature. By modifying the config to point to a malicious DLL, the attacker forces the CLR to load the malicious AppDomainManager.

Weakness 3 – Orphan service after Visual Studio uninstall

The registry key HKLM\SYSTEM\CurrentControlSet\Services\VSInstallerElevation persists even when Visual Studio is removed, allowing the attack to succeed on machines that never had VS installed.

Exploitation Process – Fully “Signature‑White”

Deployment Phase

The attacker places three files in the Visual Studio Installer directory ( C:\Program Files (x86)\Microsoft Visual Studio\Installer\): VSInstallerElevationService.exe.config – adds <etwEnable>false</etwEnable> to disable ETW and redirects appDomainManagerAssembly to the malicious DLL. Microsoft.VS.ConfigurationManager.dll – malicious AppDomainManager compiled with csc.exe. Microsoft.VS.ConfigurationHost.dll – the attacker’s beacon DLL.

The original VSInstallerElevationService.exe is left unchanged, preserving its size, timestamp, and Microsoft signature.

Trigger Phase

The Service Control Manager starts VSInstallerElevationService.exe as SYSTEM.

The CLR reads the tampered .config, sees <etwEnable>false</etwEnable>, and disables ETW.

The CLR loads the malicious AppDomainManager, bypassing strong‑name verification.

The AppDomainManager’s InitializeNewDomain() calls LoadLibrary("beacon.dll").

The beacon runs inside the process with no child processes.

The AppDomainManager invokes StartServiceCtrlDispatcherW, reports SERVICE_RUNNING, and keeps the service alive.

EDR tools observe only a Microsoft‑signed process running normally.

Persistence Mechanism

On first execution Vipere creates a scheduled task that runs on every logon:

schtasks /create /sc onlogon /ru SYSTEM /tn "Vipere" /tr "sc start VSInstallerElevationService"

The task executes the chain as SYSTEM after reboot or user logon, reviving the beacon.

Detection and Defense

Audit the service ACL and remove SERVICE_START permission from Authenticated Users.

Deploy file‑integrity monitoring for the .config and .dll files in the installer directory; alert on hash changes.

Verify removal of the VSInstallerElevationService registry entry after Visual Studio uninstall.

Monitor execution of csc.exe in non‑development environments.

Watch VSInstallerElevationService.exe for loading of non‑Microsoft modules.

Audit access to HKLM\SYSTEM\CurrentControlSet\Services\VSInstallerElevation.

Download

GitHub repository: https://github.com/0xaled/Vipere