BugTraq
Defense in depth -- the Microsoft way (part 33): arbitrary code execution (and UAC bypass) via RegEdit.exe Sep 08 2015 05:04PM
Stefan Kanthak (stefan kanthak nexgo de) (1 replies)
Hi @ll,

part 31 (see <http://seclists.org/fulldisclosure/2015/Mar/92>)
showed how to execute arbitrary (rogue) executables planted as
%SystemRoot%\System32\RegEdit.exe, %SystemRoot%\System32\Explorer.exe
etc. instead of %SystemRoot%\RegEdit.exe, %SystemRoot%\Explorer.exe
etc., including a possible UAC bypass.

This works since Microsoft (mis)places these executables (for
historical "reasons") in %windir%\ alias %SystemRoot%\ (the path
returned from the GetWindowsDirectory() function), although the
hard-coded search order uses %SystemRoot%\System32\ (the path
returned from the GetSystemDirectory() function) before %windir%alias %SystemRoot%
JFTR: in x64 versions of Windows these historical "reasons" are but
abandoned completely for 32-bit executables: the 32-bit
counterparts of all 64-bit executables located in %SystemRoot% have been moved to %SystemRoot%\SysWoW64\.
This is backwards compatible since %SystemRoot%\System32\ is
redirected to %SystemRoot%\SysWoW64\ for 32-bit executables and
due to the hard-coded search order, plus
<https://msdn.microsoft.com/en-us/library/aa384187.aspx>:

| Access to %windir%\regedit.exe is redirected to
| %windir%\SysWOW64\regedit.exe.

(Un)fortunately there is no redirection from %SystemRoot%\RegEdit.exe
to %SystemRoot%\System32\RegEdit.exe for 64-bit executables and in
x86 versions of Windows.

RegEdit.exe load various DLLs; since the hard-coded search order
(see <https://msdn.microsoft.com/en-us/library/ms682586.aspx>) uses
the application directory first it is possible to have it load
arbitrary (rogue) DLLs planted into %SystemRoot%\ instead of the
system DLLs installed in %SystemRoot%\System32\ (except for the
"known DLLs", see <https://support.microsoft.com/en-us/kb/164501>).

Of course any other executable (mis)placed in %SystemRoot%\ might be
(ab)used too!

Proof of concept (for Windows 2000 to Windows 10; use your own "sentinel"
~~~~~~~~~~~~~~~~ instead of mine for Windows NT4):

1. get <http://home.arcor.de/skanthak/download/SENTINEL.DLL> (this is a
32-bit executable [*]; the 64-bit executable is available on request);

2. copy SENTINEL.DLL as %SystemRoot%\ACLUI.DLL (use the method shown
in <http://seclists.org/fulldisclosure/2015/Mar/92> to bypass UAC);

3. execute %SystemRoot%\RegEdit.exe

Mitigation(s):
~~~~~~~~~~~~~~

1. For %! In (%SystemRoot%\*.exe
%SystemRoot%\*.dll) Do If Not Exist %SystemRoot%\System32\%~nx! MkLink /H %SystemRoot%\System32\%~nx! %!

This but only helps if RegEdit.exe is not called with its fully
qualified pathname %SystemRoot%\RegEdit.exe

2. Define ACLUI.DLL as "known DLL":

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs]
"aclui"="ACLUI.DLL"

stay tuned
Stefan Kanthak

[*] see <http://home.arcor.de/skanthak/sentinel.html>

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus