Exploiting-leaked-thread-handle

Project Zero

News and updates from the Project Zero team at GoogleMonday, March, exploiting a leaked Thread HandlePosted by logged on user, James Forshaw.
Once in awhile you'll find a bug that allows your leak a handle opened in a privileged process into a lower privileged p Rocess. I found just such a bug in the secondary Logon service on Windows, which is fixed this month as ms16-032. The bug allowed leak a thread handle with full access. This blog post is what you could use that thread handle to gain system privileges without resorting to traditional me Mory corruption techniques.The Bug itselfYou can find the issue here. The secondary Logon service is present on all modern versions for Windows, at least back to XP. The service exposes an RPC endpoint This allows a normal process to create new processes with different tokens. From a API perspective this functionality is exposed through the CREATEPROCESSWITHTOKENW and CreateProcessWithLogonW APIs . These act very similar to CreateProcessAsUser, the differences being that instead of SeAssignPrimaryTokenPrivilege being Needed (with Asuser) your instead need SeImpersonatePrivilege for Token. The logon function is a convenience which takes the logon credentials, calls LsaLogonUser and uses the resulting tokens to Create the process.
These APIs take the same parameters as the normal CreateProcess including passing new handles for Stdin/stdout/stderror. The passing of handles allows a console process ' s output and input to is redirected to other files. When creating a new process these handles is normally transferred to the new process via handle inheritance. In the secondary Logon case it can ' t does this as the service was not a real parent of the new process so instead it manual Ly duplicates the handles from the specified parent to the new process using the DuplicateHandle API with the following Code
Contains, hStdInput, Hstdoutout and Hstderror.
HANDLE standardhandles [3] = {...};
Location of the standard handle in target process PEB.
Phandle handleaddress = ...;

for (int i = 0; i < 3; + + i) {
if (standardhandles [i]) {