CVE-2022-47529

This PoC exploits an incorrect access control vulnerability (CVE-2022-47529) in RSA NetWitness Platform EDR Agent, allowing local users to tamper with the service by modifying insecure Win32 memory event objects. The exploit can stop the agent or execute arbitrary commands, bypassing tamper-protection features.

This exploit targets RSA NetWitness Platform 12.2 by manipulating insecure Win32 memory objects to modify the endpoint agent service configuration, allowing local users to stop the agent or execute arbitrary commands. The PoC demonstrates ACL modification to deny access to the 'Everyone' group, bypassing tamper-protection features.