kagancapar/cve-2022-290727-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.
I haven't posted any poc code anywhere for privilege escalation attack. The poc codes found have nothing to do with privilege escalation. For your information.
7-Zip is a free and open-source file archiver. The command line version of 7-Zip is also available for Unix-like systems, even AmigaOS is included among these. It is also compatible with DOS via the Dost Port or the HX-DOS extender, and can be run in the Windows Command Prompt.
I will write in Turkish so you can learn a bit of Turkish too.
First, I want to mention my story of discovering the vulnerability. I saw a payload that performs an XXE vulnerability on WinRAR. At the same time, it allowed executing commands via JavaScript using the HTML Helper file, ActiveXObject, and WScript.Shell. This was no different from HTA used in lolbins, and I thought about how to turn the situation in my favor.
(https://www.exploit-db.com/exploits/47526)
Actually, my goal was to get a reverse shell on the target computer after double-clicking on extensions of compression technologies like 7z, zip, rar etc., and I was wondering if I could use the HTML Helper file for that. After long fuzzing with WinAFL, I discovered a heap overflow in FzGM.exe, but since after a heap overflow my privileges would still be the same user, it was meaningless. Therefore, I did not use CreateRemoteThread because I needed to call the API, and to trigger that API I needed a chm file. When I examined the source code, I noticed incorrect operations especially in two places when calling the Windows API, and this directly caused a privilege problem. This discovery point creates a child process under FzGM.exe as seen in the image below. Normally, we would expect this process to be under hh.exe.
If I had not included the API but done the correct configuration via the function, I would have expected it to create a child process under hh.exe, but the 7-zip.chm file calls it on its own. You can see a typical example by editing the 7-zip.chm file and applying a command execution. After the heap overflow, I exploited the authorization problem of the called API, and then the misconfiguration found in the 7z.dll file, which I have been working on for a long time. There is no point in doing CreateRemoteThread(). What I need to run and call in my payload is not the HTML Helper API itself, but the point where this API is hooked via 7-zip, and I need to execute that point. However, since this payload only works with hh.exe integration, it works with functions like drag and drop. Calling the 7-zip.chm file via the HELP button in 7-zip, and redirecting the "base pointer" where the called address has an authorization problem in the payload, takes us to a higher user. The next step after that is that psexec is present in the payload and with the command psexec -s cmd.exe, it elevates to system privileges as nt authority/system.
poc video:
Most of the questions were about the ActiveX warning. You can resolve this problem basically as follows. Before the payload runs, it checks:
<'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0' -Name '1201' -Value '0' -PropertyType "DWord">
If this value is 1, a popup appears; if it is assigned a new value of 0, it is bypassed. However, it should be noted that it affects whichever user is running the payload at that moment.
I told the developer the necessary points and this was accepted by CVE. I cannot understand people thinking they are authorities and forming an impression that I need to give them the exploit. I already stated that I would release it after the update, but this disrespect before the update, I think, stems from people seeing themselves as authorities. I may never want to publish the PoC code for the privilege escalation attack; that is my free will, and I do not care at all what anyone thinks about questioning its correctness.
First method: If 7-zip does not receive an update, the 7-zip.chm file can be deleted. Second method: All users in the program should have read and execute permissions.
Related sigma rule https://github.com/kagancapar/CVE-2022-29072/blob/main/7z_CVE-2022-29072.yml
