59 lines
No EOL
2.7 KiB
Text
59 lines
No EOL
2.7 KiB
Text
# Exploit Title: Microsoft Windows AppXsvc Deployment Extension - Privilege Escalation
|
|
# Date: 2019-11-22
|
|
# Exploit Author: Abdelhamid Naceri
|
|
# Vendor Homepage: www.microsoft.com
|
|
# Tested on: Windows 10 1903
|
|
# CVE : CVE-2019-1385
|
|
|
|
|
|
Windows: "AppX Deployment Service" (AppXSVC) elevation of privilege vulnerability
|
|
|
|
Class: Local Elevation of Privileges
|
|
|
|
Description:
|
|
This Poc is exploiting a vulnerability in (AppXSvc) , abusing this vulnerability
|
|
could allow an attacker to overwrite\create file as SYSTEM which can result in EOP .
|
|
The're is 2 way to abuse the issue .
|
|
Step To Reproduce :
|
|
[1] For An Arbitrary File Creation
|
|
1-Turn %userprofile%\AppData\Local\Microsoft\WindowsApps\Backup Into a Junction To
|
|
your target directory example "c:\"
|
|
2-Open Powershell and execute the command Add-AppxPackage -RegisterByFamilyName -ForceApplicationShutdown -MainPackage Microsoft.MicrosoftEdge_8wekyb3d8bbwe
|
|
3-Check the directory the file should be created now
|
|
4-Enjoy:)
|
|
[2] To Overwrite File
|
|
1-Create a temp dir in %temp%\
|
|
2-Create a hardlink to your target file in the temp created dir
|
|
3-Turn %userprofile%\AppData\Local\Microsoft\WindowsApps\Backup Into a junction to
|
|
your temp created dir
|
|
4-Open Powershell and execute the command Add-AppxPackage -RegisterByFamilyName -ForceApplicationShutdown -MainPackage Microsoft.MicrosoftEdge_8wekyb3d8bbwe
|
|
5-Check the file again
|
|
Limitation :
|
|
when 'MicrosoftEdge.exe' is created it would inherit the directory permission which
|
|
mean the file wouldnt be writtable in majority of cases but a simple example of
|
|
abusement in the directory "c:\" <- the default acl is preventing Athenticated Users
|
|
from creating file but not modifying them so if we abused the vulnerability in "c:\"
|
|
we will have an arbitrary file created and also writeable from a normal user .
|
|
also you cant overwrite file that are not writable by SYSTEM , i didnt make a check
|
|
in the poc because in if the file is non readable by the current user the check will
|
|
return false even if the file is writtable by SYSTEM . NOTE : you can also overwrite
|
|
file which you cant even read them .
|
|
In the file creation make sure the path is writtable by SYSTEM otherwise the poc will
|
|
fail . I think 99% of folders are writtable by SYSTEM
|
|
Platform:
|
|
This has been tested on a fully patched system (latest patch -> November 2019) :
|
|
OS Edition: Microsoft Windows 10 Home
|
|
Os Version: 1903
|
|
OS Version Info: 18362.418
|
|
|
|
Additional Info
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BuldLabEx = 18362.1.amd64fre.19h1_release.190318-1202
|
|
|
|
|
|
Expected result:
|
|
The Deployment Process should fail with "ERROR_ACCESS_IS_DENIED"
|
|
Observed result :
|
|
The Deployment Process is overwritting or creating an arbitrary file as
|
|
"LOCAL SYSTEM"
|
|
|
|
NOTE : It was patched on 7/11/19 |