Local Security Vulnerability in Windows NT and Windows 2000

From: Ashot Oganesyan K. (ashot@protect-me.com)
Date: Wed Mar 27 2002 - 02:01:58 PST

  • Next message: Tom Micklovitch: "privacy issues in metor.com (a search engine)" 

    * LOCAL SECURITY VULNERABILITY IN WINDOWS NT AND WINDOWS 2000

Radim "EliCZ" Picha (Bugsat_private) discovered a vulnerability in
Windows NT 4.0 and Windows 2000. He has written an exploit called DebPloit
that shows the weakness of a local Windows NT/2000 security and totally
compromises entire security subsystem.

DebPloit uses a hole in the NT/2000 debugging subsystem and allows ANY user
with ANY privileges (even Guest and Restricted user) to execute processes in
the security context of an administrator or a local system (SYSTEM) account.
In other words, any person who have an access to the local computer can
became an administrator and do everything he/she wants.


Principle: Ask the debugging subsystem (smss.exe) to duplicate a handle to
Target (any process running on the local computer):

1. Become dbgss client (DbgUiConnectToDbg).

2. Connect to the DbgSsApiPort Local Procedure Call (LPC) port
(ZwConnectPort). Everyone can access this port.

3. Ask dbgss to handle CreateProcess SsApi with Target's client id
(ZwRequestPort).

4. Wait for dbgss to reply with CREATE_PROCESS_DEBUG_EVENT
(WaitForDebugEvent). Message contains a duplicated handle.

5. Impersonate your security context using a duplicated handle.

6. Execute any code (e.g. run an external program) in the security context
of Target.

Download DebPloit with a source code from
http://www.anticracking.sk/EliCZ/bugs/DebPloit.zip


To test your system for this vulnerability:

1. Download DebPloit.zip and unzip it to the directory on your hard drive.

2. Logoff and login again using Guest (or any other non-administrative
account) account.

3. Run ERunAsX.exe from the command line and specify a program you wish to
execute under the SYSTEM account (e.g. "ERunAsX.exe cmd").

4. Your program now runs under the SYSTEM account and you can do everything
(e.g. create new user with an administrative privileges) on the local
computer.


* HOTFIX

To close this hole and protect your computers and network against attacks
from the inside, you can use an unofficial hotfix released by SmartLine,
Inc.

DebPloitFix is a hotfix that closes the security hole using by the DebPloit
exploit. DebPloitFix is implemented as a kernel mode driver that can be run
dinamically (no need to restart your system). DebPloitFix assigns the new
security descriptor to the DbgSsApiPort LPC port so only the local system
(SYSTEM user) will be able to access this port.

Download DebPloitFix with a source code from
http://www.smartline.ru/software/DebPloitFix.zip

For more information, please visit http://www.ntutility.com/freeware.html

    This archive was generated by hypermail 2b30 : Fri Mar 29 2002 - 12:18:23 PST