Windows Exploitation Tricks: Exploiting Arbitrary File Writes For Local Meridian Of Privilege

Posted past times James Forshaw,

Previously I presented a technique to exploit arbitrary directory creation vulnerabilities on Windows to give yous read access to whatsoever file on the system. In the upcoming Spring Creators Update (RS4) the abuse of mountain points to link to files every bit I exploited inward the previous weblog ship service has been remediated. This is an illustration of a long term safety practise goodness from detailing how vulnerabilities mightiness endure exploited, giving a developer an incentive to discovery ways of mitigating the exploitation vector.

Keeping alongside that spirit inward this weblog ship service I’ll innovate a novel technique to exploit the to a greater extent than mutual instance of arbitrary file writes on Windows 10. Perhaps in i trial once to a greater extent than Microsoft mightiness endure able to harden the OS to larn into to a greater extent than hard to exploit these types of vulnerabilities. I’ll demonstrate exploitation past times describing inward item the late fixed number that reported to Microsoft (issue 1428).

An arbitrary file write vulnerability is where a user tin terminate create or modify a file inward a place they could non usually access. This mightiness endure due to a privileged service incorrectly sanitizing information passed past times the user or due to a symbolic link planting assail where the user tin terminate write a link into a place which is later on used past times the privileged service. The ideal vulnerability is i where the attacking user non alone controls the place of the file beingness written but also the entire contents. This is the type of vulnerability we’ll consider inward this weblog post.

A mutual way of exploiting arbitrary file writes is to perform DLL hijacking. When a Windows executable begins executing the initial loader inward NTDLL volition endeavor to discovery all imported DLLs. The locations that the loader checks for imported DLLs are to a greater extent than complex than you’d aspect but for our purposes tin terminate endure summarized every bit follows:

1. Check Known DLLs, which is a pre-cached listing of DLLs which are known to the OS. If found, the DLL is mapped into retentiveness from a pre-loaded department object.
2. Check the application’s directory, for illustration if importing TEST.DLL in addition to the application is inward C:\APP in addition to thus it volition banking concern gibe C:\APP\TEST.DLL.
3. Check the organisation locations, such every bit C:\WINDOWS\SYSTEM32 in addition to C:\WINDOWS.
4. If all else fails search the electrical flow surroundings PATH.

The aim of the DLL hijack is to discovery an executable which runs at a high privilege which volition charge a DLL from a place that the vulnerability allows us to write to. The hijack alone succeeds if the DLL hasn’t already been constitute inward a place checked earlier.

There are 2 problems which brand DLL hijacking annoying:

1. You typically demand to create a novel instance of a privileged procedure every bit the bulk of DLL imports are resolved when the procedure is offset executed.
2. Most organisation binaries, executables in addition to DLLs that volition run every bit a privileged user volition endure installed into SYSTEM32.

The minute occupation way that inward steps 2 in addition to iii the loader volition e'er aspect for DLLs inward SYSTEM32. Assuming that overwriting a DLL isn’t probable to endure an pick (at the to the lowest degree if the DLL is already loaded yous can’t write to the file), that makes it harder to discovery a suitable DLL to hijack. Influenza A virus subtype H5N1 typical way around these problems is to pick an executable that is non located inward SYSTEM32 in addition to which tin terminate endure easily activated, such every bit past times loading a COM server or running a scheduled task.

Even if yous discovery a suitable target executable to DLL hijack the implementation tin terminate endure quite ugly. Sometimes yous demand to implement stub exports for the master DLL, otherwise the loading of the DLL volition fail. In other cases the best house to run code is during DllMain, which introduces other problems such every bit running code within the loader lock. What would endure overnice is a privileged service that volition only charge an arbitrary DLL for us, no hijacking, no needing to spawn the “correct” privileged process. The query is, does such a service exist?

It turns out yep i does, in addition to the service itself has been abused at to the lowest degree twice previously, in i trial past times Lokihardt for a sandbox escape, in addition to in i trial past times me for user to organisation EoP. This service goes past times the raise “Microsoft (R) Diagnostics Hub Standard Collector Service,” but we’ll telephone recollect it DiagHub for short.

The DiagHub service was introduced inward Windows 10, although there’s a service that performs a similar describe called IE ETW Collector inward Windows seven in addition to 8.1. The purpose of the service is to collect diagnostic information using Event Tracing for Windows (ETW) on behalf of sandboxed applications, specifically Edge in addition to Internet Explorer. One of its interesting features is that it tin terminate endure configured to charge an arbitrary DLL from the SYSTEM32 directory, which is the exact characteristic that Lokihardt in addition to I exploited to gain elevated privileges. All the functionality for the service is exposed over a registered DCOM object, thus inward companionship to charge our DLL we’ll demand to piece of work out how to telephone recollect methods on that DCOM object. At this indicate yous tin terminate skip to the cease but if yous desire to empathize how I would croak most finding how the DCOM object is implemented, the side past times side department mightiness endure of interest.

Reverse Engineering a DCOM Object

Let’s croak through the steps I would convey to evidence in addition to discovery what interfaces an unknown DCOM object supports in addition to discovery the implementation thus nosotros tin terminate opposite engineer them. There are 2 approaches I volition typically take, croak straight for RE inward IDA Pro or similar, or practise some on-system inspection offset to narrow downwards the areas nosotros receive got to investigate. Here we’ll croak for the minute approach every bit it’s to a greater extent than informative. I can’t say how Lokihardt constitute his issue; I’m going to opt for magic.

For this approach we’ll demand some tools, specifically my OleViewDotNet v1.4+ (OVDN) tool from github every bit good every bit an installation of WinDBG from the SDK. The offset pace is to discovery the registration information for the DCOM object in addition to discovery what interfaces are accessible. We know that the DCOM object is hosted inward a service thus in i trial you’ve loaded OVDN croak to the carte du jour Registry ⇒ Local Services in addition to the tool volition charge a listing of registered organisation services which expose COM objects. If yous at nowadays discovery the  “Microsoft (R) Diagnostics Hub Standard Collector Service” service (applying a filter hither is helpful) yous should discovery the entry inward the list. If yous opened upwards the service tree node you’ll meet a child, “Diagnostics Hub Standard Collector Service,” which is the hosted DCOM object. If yous opened upwards that tree node the tool volition create the object, in addition to thus query for all remotely accessible COM interfaces to give yous a listing of interfaces the object supports. I’ve shown this inward the screenshot below:

While we’re hither it’s useful to inspect what safety is required to access the DCOM object. If yous right click the flat treenode yous tin terminate select View Access Permissions or View Launch Permissions in addition to you’ll larn a window that shows the permissions. In this instance it shows that this DCOM object volition endure accessible from IE Protected Mode every bit good every bit Edge’s AppContainer sandbox, including LPAC.

Of the listing of interfaces shown nosotros alone genuinely attention most the measure interfaces. Sometimes at that spot are interesting interfaces inward the mill but inward this instance at that spot aren’t. Of these measure interfaces at that spot are 2 nosotros attention about, the IStandardCollectorAuthorizationService and IStandardCollectorService. Just to cheat slightly I already know that it’s the IStandardCollectorService service we’re interested in, but every bit the next procedure is going to endure the same for each of the interfaces it doesn’t thing which i nosotros pick first. If yous right click the interface treenode in addition to select Properties yous tin terminate meet a flake of information most the registered interface.

There’s non much to a greater extent than information that volition assist us here, other than nosotros tin terminate meet at that spot are 8 methods on this interface. As alongside a lot of COM registration information, this value mightiness endure missing or erroneous, but inward this instance we’ll assume it’s correct. To empathize what the methods are we’ll demand to rail downwards the implementation of IStandardCollectorService inside the COM server. This noesis volition allow us to target our RE efforts to the right binary in addition to the right methods. Doing this for an in-process COM object is relatively tardily every bit nosotros tin terminate query for an object’s VTable pointer straight past times dereferencing a few pointers. However, for out-of-process it’s to a greater extent than involved. This is because the actual in-process object you’d telephone recollect is genuinely a proxy for the remote object, every bit shown inward the next diagram:

All is non lost, however; nosotros tin terminate soundless discovery the the VTable of the OOP object past times extracting the information stored most the object inward the server process. Start past times right clicking the “Diagnostics Hub Standard Collector Service” object tree node in addition to select Create Instance. This volition create a novel instance of the COM object every bit shown below:

The instance gives yous basic information such every bit the CLSID for the object which we’ll demand later (in this instance {42CBFAA7-A4A7-47BB-B422-BD10E9D02700}) every bit good every bit the listing of supported interfaces. Now nosotros demand to ensure nosotros receive got a connection to the interface we’re interested in. For that select the IStandardCollectorService interface inward the lower list, in addition to thus inward the Operations carte du jour at the bottom select Marshal ⇒ View Properties. If successful you’ll at nowadays meet the next novel view:

There’s a lot of information inward this persuasion but the 2 pieces of most involvement are the Process ID of the hosting service in addition to the Interface Pointer Identifier (IPID). In this instance the Process ID should endure obvious every bit the service is running inward its ain process, but this isn’t e'er the case—sometimes when yous create a COM object you’ve no thought which procedure is genuinely hosting the COM server thus this information is invaluable. The IPID is the unique identifier inward the hosting procedure for the server cease of the DCOM object; nosotros tin terminate utilization the Process ID in addition to the IPID inward combination to discovery this server in addition to from that discovery out the place of the actual VTable implementing the COM methods. It’s worth noting that the maximum Process ID size from the IPID is sixteen bits; however, modern versions of Windows tin terminate receive got much larger PIDs thus there’s a endangerment that you’ll receive got to discovery the procedure manually or restart the service multiple times until yous larn a suitable PID.

Now we’ll utilization a characteristic of OVDN which allows us to make into the retentiveness of the server procedure in addition to discovery the IPID information. You tin terminate access information most all processes through the principal carte du jour Object ⇒ Processes but every bit nosotros know which procedure we’re interested inward only click the View push side past times side to the Process ID inward the marshal view. You practise demand to endure running OVDN every bit an administrator otherwise you’ll non endure able to opened upwards the service process. If you’ve non done thus already the tool volition inquire yous to configure symbol back upwards every bit OVDN needs world symbols to discovery the right locations inward the COM DLLs to parse. You’ll desire to utilization the version of DBGHELP.DLL which comes alongside WinDBG every bit that supports remote symbol servers. Configure the symbols similar to the next dialog:

If everything is correctly configured in addition to you’re an administrator yous should at nowadays meet to a greater extent than details most the IPID, every bit shown below:

The 2 most useful pieces of information hither are the Interface pointer, which is the place of the heap allocated object (in instance yous desire to inspect its state), in addition to the VTable pointer for the interface. The VTable address gives us information for where just the COM server implementation is located. As nosotros tin terminate meet hither the VTable is located inward a unlike module (DiagnosticsHub.StandardCollector.Runtime) from the principal executable (DiagnosticsHub.StandardCollector.Server). We tin terminate verify the VTable address is right past times attaching to the service procedure using WinDBG in addition to dumping the symbols at the VTable address. We also know from before we’re expecting 8 methods thus nosotros tin terminate convey that into concern human relationship past times using the command:

dqs DiagnosticsHub_StandardCollector_Runtime+0x36C78 L8

Note that WinDBG converts periods inward a module raise to underscores. If successful you’ll meet the something similar to the next screenshot:

Extracting out that information nosotros at nowadays larn the raise of the methods (shown below) every bit good every bit the address inward the binary. We could laid breakpoints in addition to meet what gets called during normal operation, or convey this information in addition to start the RE process.

ATL::CComObject<StandardCollectorService>::QueryInterface

ATL::CComObjectCached<StandardCollectorService>::AddRef

ATL::CComObjectCached<StandardCollectorService>::Release

StandardCollectorService::CreateSession

StandardCollectorService::GetSession

StandardCollectorService::DestroySession

StandardCollectorService::DestroySessionAsync

StandardCollectorService::AddLifetimeMonitorProcessIdForSession

The listing of methods looks correct: they start alongside the iii measure methods for a COM object, which inward this instance are implemented past times the ATL library. Following those methods are 5 implemented past times the StandardCollectorService class. Being world symbols, this doesn’t tell us what parameters nosotros aspect to overstep to the COM server. Due to C++ names containing some type information, IDA Pro mightiness endure able to extract that information for you, notwithstanding that won’t necessarily tell yous the format of whatsoever structures which mightiness endure passed to the function. Fortunately due to how COM proxies are implemented using the Network Data Representation (NDR) interpreter to perform marshalling, it’s possible to opposite the NDR bytecode dorsum into a format nosotros tin terminate understand. In this instance croak dorsum to the master service information, right click the IStandardCollectorService treenode in addition to select View Proxy Definition. This volition larn OVDN to parse the NDR proxy information in addition to display a novel persuasion every bit shown below.

Viewing the proxy definition volition also parse out whatsoever other interfaces which that proxy library implements. This is probable to endure useful for farther RE work. The decompiled proxy definition is shown inward a C# similar pseudo code but it should endure tardily to convert into working C# or C++ every bit necessary. Notice that the proxy definition doesn’t incorporate the names of the methods but we’ve already extracted those out. So applying a flake of cleanup in addition to the method names nosotros larn a definition which looks similar the following:

[uuid("0d8af6b7-efd5-4f6d-a834-314740ab8caa")]
struct IStandardCollectorService : IUnknown {
   HRESULT CreateSession(_In_ struct Struct_24* p0,
                         _In_ IStandardCollectorClientDelegate* p1,
                         _Out_ ICollectionSession** p2);
   HRESULT GetSession(_In_ GUID* p0, _Out_ ICollectionSession** p1);
   HRESULT DestroySession(_In_ GUID* p0);
   HRESULT DestroySessionAsync(_In_ GUID* p0);
   HRESULT AddLifetimeMonitorProcessIdForSession(_In_ GUID* p0, [In] int p1);
}

There’s i final slice missing; nosotros don’t know the definition of the Struct_24 structure. It’s possible to extract this from the RE procedure but fortunately inward this instance nosotros don’t receive got to. The NDR bytecode must know how to marshal this construction across thus OVDN only extracts the construction definition out for us automatically: select the Structures tab in addition to discovery Struct_24.

As yous croak through the RE procedure yous tin terminate repeat this procedure every bit necessary until yous empathize how everything works. Now let’s larn to genuinely exploiting the DiagHub service in addition to demonstrating its utilization alongside a existent footing exploit.

Example Exploit

So after our efforts of opposite engineering, we’ll discovery that inward companionship to to charge a DLL from SYSTEM32 nosotros demand to practise the next steps:

1. Create a novel Diagnostics Session using IStandardCollectorService::CreateSession.
2. Call the ICollectionSession::AddAgent method on the novel session, passing the raise of the DLL to charge (without whatsoever path information).

The simplified loading code for ICollectionSession::AddAgent is every bit follows:

void EtwCollectionSession::AddAgent(LPWCSTR dll_path,
                                   REFGUID guid) {
 WCHAR valid_path[MAX_PATH];
 if ( !GetValidAgentPath(dll_path, valid_path)) {
   return E_INVALID_AGENT_PATH;
 HMODULE modern = LoadLibraryExW(valid_path,
       nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
 dll_get_class_obj = GetProcAddress(hModule, "DllGetClassObject");
 return dll_get_class_obj(guid);
}

We tin terminate meet that it checks that the agent path is valid in addition to returns a total path (this is where the previous EoP bugs existed, insufficient checks). This path is loading using LoadLibraryEx, in addition to thus the DLL is queried for the exported method DllGetClassObject which is in addition to thus called. Therefore to easily larn code execution all nosotros demand is to implement that method in addition to drib the file into SYSTEM32. The implemented DllGetClassObject will endure called exterior the loader lock thus nosotros tin terminate practise anything nosotros want. The next code (error treatment removed) volition endure sufficient to charge a DLL called dummy.dll.

IStandardCollectorService* service;
CoCreateInstance(CLSID_CollectorService, nullptr, CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&service));

SessionConfiguration config = {};
config.version = 1;
config.monitor_pid = ::GetCurrentProcessId();
CoCreateGuid(&config.guid);
config.path = ::SysAllocString(L"C:\Dummy");
ICollectionSession* session;
service->CreateSession(&config, nullptr, &session);

GUID agent_guid;
CoCreateGuid(&agent_guid);
session->AddAgent(L"dummy.dll", agent_guid);

All nosotros demand at nowadays is the arbitrary file write thus that nosotros tin terminate drib a DLL into SYSTEM32, charge it in addition to get upwards our privileges. For this I’ll demonstrate using a vulnerability I constitute inward the SvcMoveFileInheritSecurity RPC method inward the organisation Storage Service. This component division caught my attending due to its utilization inward an exploit for a vulnerability inward ALPC discovered in addition to presented past times Clément Rouault & Thomas Imbert at PACSEC 2017. While this method was only a useful exploit primitive for the vulnerability I realized it has non one, but 2 actual vulnerabilities lurking inward it (at to the lowest degree from a normal user privilege). The code prior to whatsoever fixes for SvcMoveFileInheritSecurity looked similar the following:

void SvcMoveFileInheritSecurity(LPCWSTR lpExistingFileName,
                               LPCWSTR lpNewFileName,
                               DWORD dwFlags) {
 PACL pAcl;
 if (!RpcImpersonateClient()) {
   // Move file piece impersonating.
   if (MoveFileEx(lpExistingFileName, lpNewFileName, dwFlags)) {
     RpcRevertToSelf();
     // Copy inherited DACL piece not.
     InitializeAcl(&pAcl, 8, ACL_REVISION);
     DWORD condition = SetNamedSecurityInfo(lpNewFileName, SE_FILE_OBJECT,
         UNPROTECTED_DACL_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
         nullptr, nullptr, &pAcl, nullptr);
       if (status != ERROR_SUCCESS)
         MoveFileEx(lpNewFileName, lpExistingFileName, dwFlags);
   }
   else {
     // Copy file instead...
     RpcRevertToSelf();
   }
 }
}

The purpose of this method seems to endure to motility a file in addition to thus apply whatsoever inherited ACE’s to the DACL from the novel directory location. This would endure necessary every bit when a file is moved on the same volume, the former filename is unlinked in addition to the file is linked to the novel location. However, the novel file volition keep the safety assigned from its master location. Inherited ACEs are alone applied when a novel file is created inward a directory, or every bit inward this case, the ACEs are explicitly applied past times calling a component division such every bit SetNamedSecurityInfo.

To ensure this method doesn’t allow anyone to motility an arbitrary file piece running every bit the service’s user, which inward this instance is Local System, the RPC caller is impersonated. The problem starts at in i trial after the offset telephone recollect to MoveFileEx, the impersonation is reverted in addition to SetNamedSecurityInfo is called. If that telephone recollect fails in addition to thus the code calls MoveFileEx in i trial to a greater extent than to evidence in addition to revert the master motility operation. This is the offset vulnerability; it’s possible that the master filename place at nowadays points somewhere else, such every bit through the abuse of symbolic links. It’s pretty tardily to crusade SetNamedSecurityInfo to fail, only add together a Deny ACL for Local System to the file’s ACE for WRITE_DAC in addition to it’ll provide an mistake which causes the revert in addition to yous larn an arbitrary file creation. This was reported every bit number 1427.

This is non inward fact the vulnerability we’ll endure exploiting, every bit that would endure likewise easy. Instead we’ll exploit a minute vulnerability inward the same code: the fact that nosotros tin terminate larn the service to telephone recollect SetNamedSecurityInfo on whatsoever file nosotros similar piece running every bit Local System. This tin terminate endure achieved either past times abusing the impersonated device map to redirect the local drive missive of the alphabet (such every bit C:) when doing the initial MoveFileEx, which in addition to thus results inward lpNewFileName pointing to an arbitrary location, or to a greater extent than interestingly abusing hard links. This was reported every bit number 1428. We tin terminate exploit this using hard links every bit follows:

1. Create a hard link to a target file inward SYSTEM32 that nosotros desire to overwrite. We tin terminate practise this every bit yous don’t demand to receive got write privileges to a file to create a hard link to it, at to the lowest degree exterior of a sandbox.
2. Create a novel directory place that has an inheritable ACE for a grouping such every bit Everyone or Authenticated Users to allow for change of whatsoever novel file. You don’t fifty-fifty typically demand to practise this explicitly; for example, whatsoever novel directory created inward the root of the C: drive has an inherited ACE for Authenticated Users. Then a asking tin terminate endure made to the RPC service to motility the hardlinked file to the novel directory location. The motility succeeds nether impersonation every bit long every bit nosotros receive got FILE_DELETE_CHILD access to the master place in addition to FILE_ADD_FILE inward the novel location, which nosotros tin terminate arrange.
3. The service volition at nowadays telephone recollect SetNamedSecurityInfo on the moved hardlink file. SetNamedSecurityInfo volition pick upwards the inherited ACEs from the novel directory place in addition to apply them to the hardlinked file. The argue the ACEs are applied to the hardlinked file is from the perspective of SetNamedSecurityInfo the hardlinked file is inward the novel location, fifty-fifty though the master target file nosotros linked to was inward SYSTEM32.

By exploiting this nosotros tin terminate modify the safety of whatsoever file that Local System tin terminate access for WRITE_DAC access. Therefore nosotros tin terminate modify a file inward SYSTEM32, in addition to thus utilization the DiagHub service to charge it. There is a slight problem, however. The bulk of files inward SYSTEM32 are genuinely owned past times the TrustedInstaller grouping in addition to thus cannot endure modified, fifty-fifty past times Local System. We demand to discovery a file nosotros tin terminate write to which isn’t owned past times TrustedInstaller. Also we’d desire to pick a file that won’t crusade the OS install to larn corrupt. We don’t attention most the file’s extension every bit AddAgent only checks that the file exists in addition to loads it alongside LoadLibraryEx. There are a number of ways nosotros tin terminate discovery a suitable file, such every bit using the SysInternals AccessChk utility, but to endure 100% for certain that the Storage Service’s token tin terminate modify the file we’ll utilization my NtObjectManager PowerShell module (specifically its Get-AccessibleFile cmdlet, which accepts a procedure to practise the access banking concern gibe from). While the module was designed for checking accessible files from a sandbox, it also works to banking concern gibe for files accessible past times privileged services. If yous run the next script every bit an administrator alongside the module installed the $files variable volition incorporate a listing of files that the Storage Service has WRITE_DAC access to.

Import-Module NtObjectManager

Start-Service -Name "StorSvc"
Set-NtTokenPrivilege SeDebugPrivilege | Out-Null
$files = Use-NtObject($p = Get-NtProcess -ServiceName "StorSvc") {
   Get-AccessibleFile -Win32Path C:\Windows\system32 -Recurse `
    -MaxDepth 1 -FormatWin32Path -AccessRights WriteDac -CheckMode FilesOnly
}

Looking through the listing of files I decided to pick on the file license.rtf, which contains a brusk license contention for Windows. The wages of this file is it’s rattling probable to endure non endure critical to the functioning of the organisation in addition to thus overwriting it shouldn’t crusade the installation to larn corrupted.

So putting it all together:

1. Use the Storage Service vulnerability to alter the safety of the license.rtf file within SYSTEM32.
2. Copy a DLL, which implements DllGetClassObject over the license.rtf file.
3. Use the DiagHub service to charge our modified license file every bit a DLL, larn code execution every bit Local System in addition to practise whatever nosotros want.

If you’re interested inward seeing a fully working example, I’ve uploaded a total exploit to the master number on the tracker.

Wrapping Up

In this weblog ship service I’ve described a useful exploit primitive for Windows 10, which yous tin terminate fifty-fifty utilization from some sandboxed environments such every bit Edge LPAC. Finding these sorts of primitives makes exploitation much simpler in addition to less error-prone. Also I’ve given yous a sense of savour of how yous tin terminate croak most finding your ain bugs inward similar DCOM implementations.