Windows Exploitation Tricks: Exploiting Arbitrary File Writes For Local Meridian Of Privilege

Posted yesteryear James Forshaw,

Previously I presented a technique to exploit arbitrary directory creation vulnerabilities on Windows to give you lot read access to whatsoever file on the system. In the upcoming Spring Creators Update (RS4) the abuse of mountain points to link to files every bit I exploited inwards the previous weblog postal service has been remediated. This is an instance of a long term safety exercise goodness from detailing how vulnerabilities powerfulness locomote exploited, giving a developer an incentive to notice ways of mitigating the exploitation vector.

Keeping alongside that spirit inwards this weblog postal service I’ll innovate a novel technique to exploit the to a greater extent than mutual instance of arbitrary file writes on Windows 10. Perhaps i time over again Microsoft powerfulness locomote able to harden the OS to come inwards to a greater extent than hard to exploit these types of vulnerabilities. I’ll demonstrate exploitation yesteryear describing inwards exceptional the of late fixed number that reported to Microsoft (issue 1428).

An arbitrary file write vulnerability is where a user tin create or modify a file inwards a place they could non unremarkably access. This powerfulness locomote due to a privileged service incorrectly sanitizing information passed yesteryear the user or due to a symbolic link planting assail where the user tin write a link into a place which is later used yesteryear the privileged service. The ideal vulnerability is i where the attacking user non entirely controls the place of the file beingness written but also the entire contents. This is the type of vulnerability we’ll consider inwards this weblog post.

A mutual way of exploiting arbitrary file writes is to perform DLL hijacking. When a Windows executable begins executing the initial loader inwards NTDLL volition elbow grease to notice all imported DLLs. The locations that the loader checks for imported DLLs are to a greater extent than complex than you’d await but for our purposes tin locomote summarized every bit follows:

1. Check Known DLLs, which is a pre-cached listing of DLLs which are known to the OS. If found, the DLL is mapped into retentiveness from a pre-loaded department object.
2. Check the application’s directory, for instance if importing TEST.DLL as well as the application is inwards C:\APP as well as then it volition banking concern stand upward for C:\APP\TEST.DLL.
3. Check the organization locations, such every bit C:\WINDOWS\SYSTEM32 as well as C:\WINDOWS.
4. If all else fails search the electrical flow surroundings PATH.

The aim of the DLL hijack is to notice an executable which runs at a high privilege which volition charge a DLL from a place that the vulnerability allows us to write to. The hijack entirely succeeds if the DLL hasn’t already been flora inwards a place checked earlier.

There are ii problems which brand DLL hijacking annoying:

1. You typically demand to create a novel instance of a privileged procedure every bit the bulk of DLL imports are resolved when the procedure is commencement executed.
2. Most organization binaries, executables as well as DLLs that volition run every bit a privileged user volition locomote installed into SYSTEM32.

The instant employment agency that inwards steps 2 as well as three the loader volition e'er facial expression for DLLs inwards SYSTEM32. Assuming that overwriting a DLL isn’t probable to locomote an pick (at the to the lowest degree if the DLL is already loaded you lot can’t write to the file), that makes it harder to notice a suitable DLL to hijack. H5N1 typical way around these problems is to pick an executable that is non located inwards SYSTEM32 as well as which tin locomote easily activated, such every bit yesteryear loading a COM server or running a scheduled task.

Even if you lot notice a suitable target executable to DLL hijack the implementation tin locomote quite ugly. Sometimes you lot demand to implement stub exports for the master copy DLL, otherwise the loading of the DLL volition fail. In other cases the best house to run code is during DllMain, which introduces other problems such every bit running code within the loader lock. What would locomote prissy is a privileged service that volition simply charge an arbitrary DLL for us, no hijacking, no needing to spawn the “correct” privileged process. The enquiry is, does such a service exist?

It turns out yeah i does, as well as the service itself has been abused at to the lowest degree twice previously, i time yesteryear Lokihardt for a sandbox escape, as well as i time yesteryear me for user to organization EoP. This service goes yesteryear the cite “Microsoft (R) Diagnostics Hub Standard Collector Service,” but we’ll telephone band it DiagHub for short.

The DiagHub service was introduced inwards Windows 10, although there’s a service that performs a similar chore called IE ETW Collector inwards Windows vii as well as 8.1. The purpose of the service is to collect diagnostic information using Event Tracing for Windows (ETW) on behalf of sandboxed applications, specifically Edge as well as Internet Explorer. One of its interesting features is that it tin locomote configured to charge an arbitrary DLL from the SYSTEM32 directory, which is the exact characteristic that Lokihardt as well as I exploited to gain elevated privileges. All the functionality for the service is exposed over a registered DCOM object, thus inwards lodge to charge our DLL we’ll demand to piece of work out how to telephone band methods on that DCOM object. At this indicate you lot tin skip to the goal but if you lot desire to empathise how I would croak well-nigh finding how the DCOM object is implemented, the side yesteryear side department powerfulness locomote of interest.

Reverse Engineering a DCOM Object

Let’s croak through the steps I would bring to essay as well as notice what interfaces an unknown DCOM object supports as well as notice the implementation thus nosotros tin opposite engineer them. There are ii approaches I volition typically take, croak straight for RE inwards IDA Pro or similar, or exercise some on-system inspection commencement to narrow downwards the areas nosotros receive got to investigate. Here we’ll croak for the instant approach every bit it’s to a greater extent than informative. I can’t say how Lokihardt flora his issue; I’m going to opt for magic.

For this approach we’ll demand some tools, specifically my OleViewDotNet v1.4+ (OVDN) tool from github every bit good every bit an installation of WinDBG from the SDK. The commencement footstep is to notice the registration information for the DCOM object as well as uncovering what interfaces are accessible. We know that the DCOM object is hosted inwards a service thus i time you’ve loaded OVDN croak to the carte du jour Registry ⇒ Local Services as well as the tool volition charge a listing of registered organization services which expose COM objects. If you lot at nowadays notice the  “Microsoft (R) Diagnostics Hub Standard Collector Service” service (applying a filter hither is helpful) you lot should notice the entry inwards the list. If you lot opened upward the service tree node you’ll run across a child, “Diagnostics Hub Standard Collector Service,” which is the hosted DCOM object. If you lot opened upward that tree node the tool volition create the object, as well as then query for all remotely accessible COM interfaces to give you lot a listing of interfaces the object supports. I’ve shown this inwards the screenshot below:

While we’re hither it’s useful to inspect what safety is required to access the DCOM object. If you lot right click the shape treenode you lot tin select View Access Permissions or View Launch Permissions as well as you’ll larn a window that shows the permissions. In this instance it shows that this DCOM object volition locomote accessible from IE Protected Mode every bit good every bit Edge’s AppContainer sandbox, including LPAC.

Of the listing of interfaces shown nosotros entirely genuinely aid well-nigh the criterion interfaces. Sometimes at that spot are interesting interfaces inwards the manufacturing flora but inwards this instance at that spot aren’t. Of these criterion interfaces at that spot are ii nosotros aid about, the IStandardCollectorAuthorizationService and IStandardCollectorService. Just to cheat slightly I already know that it’s the IStandardCollectorService service we’re interested in, but every bit the next procedure is going to locomote the same for each of the interfaces it doesn’t thing which i nosotros pick first. If you lot right click the interface treenode as well as select Properties you lot tin run across a combat of information well-nigh the registered interface.

There’s non much to a greater extent than information that volition assist us here, other than nosotros tin run across at that spot are 8 methods on this interface. As alongside a lot of COM registration information, this value powerfulness locomote missing or erroneous, but inwards this instance we’ll assume it’s correct. To empathise what the methods are we’ll demand to rail downwards the implementation of IStandardCollectorService inside the COM server. This cognition volition allow us to target our RE efforts to the right binary as well as the right methods. Doing this for an in-process COM object is relatively tardily every bit nosotros tin query for an object’s VTable pointer direct yesteryear dereferencing a few pointers. However, for out-of-process it’s to a greater extent than involved. This is because the actual in-process object you’d telephone band is genuinely a proxy for the remote object, every bit shown inwards the next diagram:

All is non lost, however; nosotros tin silent notice the the VTable of the OOP object yesteryear extracting the information stored well-nigh the object inwards the server process. Start yesteryear right clicking the “Diagnostics Hub Standard Collector Service” object tree node as well as select Create Instance. This volition create a novel instance of the COM object every bit shown below:

The instance gives you lot basic information such every bit the CLSID for the object which we’ll demand later (in this instance {42CBFAA7-A4A7-47BB-B422-BD10E9D02700}) every bit good every bit the listing of supported interfaces. Now nosotros demand to ensure nosotros receive got a connection to the interface we’re interested in. For that select the IStandardCollectorService interface inwards the lower list, as well as then inwards the Operations carte du jour at the bottom select Marshal ⇒ View Properties. If successful you’ll at nowadays run across the next novel view:

There’s a lot of information inwards this thought but the ii pieces of most involvement are the Process ID of the hosting service as well as the Interface Pointer Identifier (IPID). In this instance the Process ID should locomote obvious every bit the service is running inwards its ain process, but this isn’t e'er the case—sometimes when you lot create a COM object you’ve no thought which procedure is genuinely hosting the COM server thus this information is invaluable. The IPID is the unique identifier inwards the hosting procedure for the server goal of the DCOM object; nosotros tin usage the Process ID as well as the IPID inwards combination to notice this server as well as from that notice out the place of the actual VTable implementing the COM methods. It’s worth noting that the maximum Process ID size from the IPID is xvi bits; however, modern versions of Windows tin receive got much larger PIDs thus there’s a lead chances that you’ll receive got to notice the procedure manually or restart the service multiple times until you lot larn a suitable PID.

Now we’ll usage a characteristic of OVDN which allows us to make into the retentiveness of the server procedure as well as notice the IPID information. You tin access information well-nigh all processes through the primary carte du jour Object ⇒ Processes but every bit nosotros know which procedure we’re interested inwards simply click the View push side yesteryear side to the Process ID inwards the marshal view. You exercise demand to locomote running OVDN every bit an administrator otherwise you’ll non locomote able to opened upward the service process. If you’ve non done thus already the tool volition inquire you lot to configure symbol back upward every bit OVDN needs world symbols to notice the right locations inwards the COM DLLs to parse. You’ll desire to usage the version of DBGHELP.DLL which comes alongside WinDBG every bit that supports remote symbol servers. Configure the symbols similar to the next dialog:

If everything is correctly configured as well as you’re an administrator you lot should at nowadays run across to a greater extent than details well-nigh the IPID, every bit shown below:

The ii most useful pieces of information hither are the Interface pointer, which is the place of the heap allocated object (in instance you lot desire to inspect its state), as well as the VTable pointer for the interface. The VTable address gives us information for where just the COM server implementation is located. As nosotros tin run across hither the VTable is located inwards a unlike module (DiagnosticsHub.StandardCollector.Runtime) from the primary executable (DiagnosticsHub.StandardCollector.Server). We tin verify the VTable address is right yesteryear attaching to the service procedure using WinDBG as well as dumping the symbols at the VTable address. We also know from before we’re expecting 8 methods thus nosotros tin bring that into draw of piece of work concern human relationship yesteryear using the command:

dqs DiagnosticsHub_StandardCollector_Runtime+0x36C78 L8

Note that WinDBG converts periods inwards a module cite to underscores. If successful you’ll run across the something similar to the next screenshot:

Extracting out that information nosotros at nowadays larn the cite of the methods (shown below) every bit good every bit the address inwards the binary. We could laid breakpoints as well as run across what gets called during normal operation, or bring this information as well as start the RE process.

ATL::CComObject<StandardCollectorService>::QueryInterface

ATL::CComObjectCached<StandardCollectorService>::AddRef

ATL::CComObjectCached<StandardCollectorService>::Release

StandardCollectorService::CreateSession

StandardCollectorService::GetSession

StandardCollectorService::DestroySession

StandardCollectorService::DestroySessionAsync

StandardCollectorService::AddLifetimeMonitorProcessIdForSession

The listing of methods looks correct: they start alongside the three criterion methods for a COM object, which inwards this instance are implemented yesteryear the ATL library. Following those methods are 5 implemented yesteryear the StandardCollectorService class. Being world symbols, this doesn’t tell us what parameters nosotros await to top to the COM server. Due to C++ names containing some type information, IDA Pro powerfulness locomote able to extract that information for you, withal that won’t necessarily tell you lot the format of whatsoever structures which powerfulness locomote passed to the function. Fortunately due to how COM proxies are implemented using the Network Data Representation (NDR) interpreter to perform marshalling, it’s possible to opposite the NDR bytecode dorsum into a format nosotros tin understand. In this instance croak dorsum to the master copy service information, right click the IStandardCollectorService treenode as well as select View Proxy Definition. This volition larn OVDN to parse the NDR proxy information as well as display a novel thought every bit shown below.

Viewing the proxy definition volition also parse out whatsoever other interfaces which that proxy library implements. This is probable to locomote useful for farther RE work. The decompiled proxy definition is shown inwards a C# similar pseudo code but it should locomote tardily to convert into working C# or C++ every bit necessary. Notice that the proxy definition doesn’t incorporate the names of the methods but we’ve already extracted those out. So applying a combat of cleanup as well as the method names nosotros larn a definition which looks similar the following:

[uuid("0d8af6b7-efd5-4f6d-a834-314740ab8caa")]
struct IStandardCollectorService : IUnknown {
   HRESULT CreateSession(_In_ struct Struct_24* p0,
                         _In_ IStandardCollectorClientDelegate* p1,
                         _Out_ ICollectionSession** p2);
   HRESULT GetSession(_In_ GUID* p0, _Out_ ICollectionSession** p1);
   HRESULT DestroySession(_In_ GUID* p0);
   HRESULT DestroySessionAsync(_In_ GUID* p0);
   HRESULT AddLifetimeMonitorProcessIdForSession(_In_ GUID* p0, [In] int p1);
}

There’s i final slice missing; nosotros don’t know the definition of the Struct_24 structure. It’s possible to extract this from the RE procedure but fortunately inwards this instance nosotros don’t receive got to. The NDR bytecode must know how to marshal this construction across thus OVDN simply extracts the construction definition out for us automatically: select the Structures tab as well as notice Struct_24.

As you lot croak through the RE procedure you lot tin repeat this procedure every bit necessary until you lot empathise how everything works. Now let’s larn to genuinely exploiting the DiagHub service as well as demonstrating its usage alongside a existent the world exploit.

Example Exploit

So after our efforts of opposite engineering, we’ll uncovering that inwards lodge to to charge a DLL from SYSTEM32 nosotros demand to exercise the next steps:

1. Create a novel Diagnostics Session using IStandardCollectorService::CreateSession.
2. Call the ICollectionSession::AddAgent method on the novel session, passing the cite of the DLL to charge (without whatsoever path information).

The simplified loading code for ICollectionSession::AddAgent is every bit follows:

void EtwCollectionSession::AddAgent(LPWCSTR dll_path,
                                   REFGUID guid) {
 WCHAR valid_path[MAX_PATH];
 if ( !GetValidAgentPath(dll_path, valid_path)) {
   return E_INVALID_AGENT_PATH;
 HMODULE modern = LoadLibraryExW(valid_path,
       nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
 dll_get_class_obj = GetProcAddress(hModule, "DllGetClassObject");
 return dll_get_class_obj(guid);
}

We tin run across that it checks that the agent path is valid as well as returns a total path (this is where the previous EoP bugs existed, insufficient checks). This path is loading using LoadLibraryEx, as well as then the DLL is queried for the exported method DllGetClassObject which is as well as then called. Therefore to easily larn code execution all nosotros demand is to implement that method as well as drib the file into SYSTEM32. The implemented DllGetClassObject will locomote called exterior the loader lock thus nosotros tin exercise anything nosotros want. The next code (error treatment removed) volition locomote sufficient to charge a DLL called dummy.dll.

IStandardCollectorService* service;
CoCreateInstance(CLSID_CollectorService, nullptr, CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&service));

SessionConfiguration config = {};
config.version = 1;
config.monitor_pid = ::GetCurrentProcessId();
CoCreateGuid(&config.guid);
config.path = ::SysAllocString(L"C:\Dummy");
ICollectionSession* session;
service->CreateSession(&config, nullptr, &session);

GUID agent_guid;
CoCreateGuid(&agent_guid);
session->AddAgent(L"dummy.dll", agent_guid);

All nosotros demand at nowadays is the arbitrary file write thus that nosotros tin drib a DLL into SYSTEM32, charge it as well as lift our privileges. For this I’ll demonstrate using a vulnerability I flora inwards the SvcMoveFileInheritSecurity RPC method inwards the organization Storage Service. This component subdivision caught my attending due to its usage inwards an exploit for a vulnerability inwards ALPC discovered as well as presented yesteryear Clément Rouault & Thomas Imbert at PACSEC 2017. While this method was simply a useful exploit primitive for the vulnerability I realized it has non one, but ii actual vulnerabilities lurking inwards it (at to the lowest degree from a normal user privilege). The code prior to whatsoever fixes for SvcMoveFileInheritSecurity looked similar the following:

void SvcMoveFileInheritSecurity(LPCWSTR lpExistingFileName,
                               LPCWSTR lpNewFileName,
                               DWORD dwFlags) {
 PACL pAcl;
 if (!RpcImpersonateClient()) {
   // Move file piece impersonating.
   if (MoveFileEx(lpExistingFileName, lpNewFileName, dwFlags)) {
     RpcRevertToSelf();
     // Copy inherited DACL piece not.
     InitializeAcl(&pAcl, 8, ACL_REVISION);
     DWORD condition = SetNamedSecurityInfo(lpNewFileName, SE_FILE_OBJECT,
         UNPROTECTED_DACL_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
         nullptr, nullptr, &pAcl, nullptr);
       if (status != ERROR_SUCCESS)
         MoveFileEx(lpNewFileName, lpExistingFileName, dwFlags);
   }
   else {
     // Copy file instead...
     RpcRevertToSelf();
   }
 }
}

The purpose of this method seems to locomote to motion a file as well as then apply whatsoever inherited ACE’s to the DACL from the novel directory location. This would locomote necessary every bit when a file is moved on the same volume, the onetime filename is unlinked as well as the file is linked to the novel location. However, the novel file volition hold the safety assigned from its master copy location. Inherited ACEs are entirely applied when a novel file is created inwards a directory, or every bit inwards this case, the ACEs are explicitly applied yesteryear calling a component subdivision such every bit SetNamedSecurityInfo.

To ensure this method doesn’t allow anyone to motion an arbitrary file piece running every bit the service’s user, which inwards this instance is Local System, the RPC caller is impersonated. The problem starts at nowadays after the commencement telephone band to MoveFileEx, the impersonation is reverted as well as SetNamedSecurityInfo is called. If that telephone band fails as well as then the code calls MoveFileEx over again to essay as well as revert the master copy motion operation. This is the commencement vulnerability; it’s possible that the master copy filename place at nowadays points somewhere else, such every bit through the abuse of symbolic links. It’s pretty tardily to crusade SetNamedSecurityInfo to fail, simply add together a Deny ACL for Local System to the file’s ACE for WRITE_DAC as well as it’ll provide an mistake which causes the revert as well as you lot larn an arbitrary file creation. This was reported every bit number 1427.

This is non inwards fact the vulnerability we’ll locomote exploiting, every bit that would locomote besides easy. Instead we’ll exploit a instant vulnerability inwards the same code: the fact that nosotros tin larn the service to telephone band SetNamedSecurityInfo on whatsoever file nosotros similar piece running every bit Local System. This tin locomote achieved either yesteryear abusing the impersonated device map to redirect the local drive alphabetic quality (such every bit C:) when doing the initial MoveFileEx, which as well as then results inwards lpNewFileName pointing to an arbitrary location, or to a greater extent than interestingly abusing hard links. This was reported every bit number 1428. We tin exploit this using hard links every bit follows:

1. Create a hard link to a target file inwards SYSTEM32 that nosotros desire to overwrite. We tin exercise this every bit you lot don’t demand to receive got write privileges to a file to create a hard link to it, at to the lowest degree exterior of a sandbox.
2. Create a novel directory place that has an inheritable ACE for a grouping such every bit Everyone or Authenticated Users to allow for alteration of whatsoever novel file. You don’t fifty-fifty typically demand to exercise this explicitly; for example, whatsoever novel directory created inwards the root of the C: drive has an inherited ACE for Authenticated Users. Then a asking tin locomote made to the RPC service to motion the hardlinked file to the novel directory location. The motion succeeds nether impersonation every bit long every bit nosotros receive got FILE_DELETE_CHILD access to the master copy place as well as FILE_ADD_FILE inwards the novel location, which nosotros tin arrange.
3. The service volition at nowadays telephone band SetNamedSecurityInfo on the moved hardlink file. SetNamedSecurityInfo volition pick upward the inherited ACEs from the novel directory place as well as apply them to the hardlinked file. The argue the ACEs are applied to the hardlinked file is from the perspective of SetNamedSecurityInfo the hardlinked file is inwards the novel location, fifty-fifty though the master copy target file nosotros linked to was inwards SYSTEM32.

By exploiting this nosotros tin modify the safety of whatsoever file that Local System tin access for WRITE_DAC access. Therefore nosotros tin modify a file inwards SYSTEM32, as well as then usage the DiagHub service to charge it. There is a slight problem, however. The bulk of files inwards SYSTEM32 are genuinely owned yesteryear the TrustedInstaller grouping as well as thus cannot locomote modified, fifty-fifty yesteryear Local System. We demand to notice a file nosotros tin write to which isn’t owned yesteryear TrustedInstaller. Also we’d desire to pick a file that won’t crusade the OS install to croak corrupt. We don’t aid well-nigh the file’s extension every bit AddAgent only checks that the file exists as well as loads it alongside LoadLibraryEx. There are a number of ways nosotros tin notice a suitable file, such every bit using the SysInternals AccessChk utility, but to locomote 100% for sure that the Storage Service’s token tin modify the file we’ll usage my NtObjectManager PowerShell module (specifically its Get-AccessibleFile cmdlet, which accepts a procedure to exercise the access banking concern stand upward for from). While the module was designed for checking accessible files from a sandbox, it also works to banking concern stand upward for for files accessible yesteryear privileged services. If you lot run the next script every bit an administrator alongside the module installed the $files variable volition incorporate a listing of files that the Storage Service has WRITE_DAC access to.

Import-Module NtObjectManager

Start-Service -Name "StorSvc"
Set-NtTokenPrivilege SeDebugPrivilege | Out-Null
$files = Use-NtObject($p = Get-NtProcess -ServiceName "StorSvc") {
   Get-AccessibleFile -Win32Path C:\Windows\system32 -Recurse `
    -MaxDepth 1 -FormatWin32Path -AccessRights WriteDac -CheckMode FilesOnly
}

Looking through the listing of files I decided to pick on the file license.rtf, which contains a brusque license arguing for Windows. The wages of this file is it’s real probable to locomote non locomote critical to the functioning of the organization as well as thus overwriting it shouldn’t crusade the installation to croak corrupted.

So putting it all together:

1. Use the Storage Service vulnerability to alter the safety of the license.rtf file within SYSTEM32.
2. Copy a DLL, which implements DllGetClassObject over the license.rtf file.
3. Use the DiagHub service to charge our modified license file every bit a DLL, larn code execution every bit Local System as well as exercise whatever nosotros want.

If you’re interested inwards seeing a fully working example, I’ve uploaded a total exploit to the master copy number on the tracker.

Wrapping Up

In this weblog postal service I’ve described a useful exploit primitive for Windows 10, which you lot tin fifty-fifty usage from some sandboxed environments such every bit Edge LPAC. Finding these sorts of primitives makes exploitation much simpler as well as less error-prone. Also I’ve given you lot a sense of savour of how you lot tin croak well-nigh finding your ain bugs inwards similar DCOM implementations.