Microsoft Windows autorun.inf Vulnerability

Bugtraq ID:	993
Class:	Configuration Error
CVE:	CVE-2000-0155
Remote:	No
Local:	Yes
Published:	Feb 18 2000 12:00AM
Updated:	Jul 11 2009 01:56AM
Credit:	Posted to Bugtraq on February 18, 2000 by Eric Stevens <[email protected]>.
Vulnerable:	Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0 Microsoft Windows 98 Microsoft Windows 95
Not Vulnerable:

Microsoft Windows autorun.inf Vulnerability

The Windows Autorun feature was designed to allow an executable and an icon to be specified for any piece of removable media. Upon insertion, the icon would be displayed for the drive, and the executable would automatically run. This feature also applies to fixed and networked drives however, making it much easier to abuse. Any user with write access to the root of a logical drive can install an executable and specify it in an autorun.inf file. Anytime that drive is accessed later, the code will run with the privileges of the currently logged in user. This could be used in privilege escalation attacks.

Microsoft Windows autorun.inf Vulnerability

As a test, make an autorun.inf file in C:\ with the following contents:
[autorun]
open=<path>notepad.exe

If your system is vulnerable, 'opening' C: should result in notepad strating up. Also, if you right-click on C: you should the Autoplay option in the drop-down menu.

The following exploit has been provided by Nelson Brito <[email protected]>:Step by Step:

1 - find a admin's mount point(a.k.a. home directory);
2 - place the autorun.inf and autorun2.exe on there;
3 - drop the admin's connection(use your prefered DoS tool);
4 - try to connect as user nelson and password nelson;
5 - BINDO, you are now a member of "Administrators" group(Stand Alone
Servers) or
"Domain Admins" gourp(PDC Servers).

Microsoft Windows autorun.inf Vulnerability

Solution:
There are two registry settings that control which drives can be recognized by the Autorun feature, both located in:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

NoDriveTypeAutoRun
This value specifies drive types that will be checked for Autorun.inf files.
Each bit of the first byte of the value corresponds to a drive type, and a value of 1 disables Autorun for that drive type. Starting with bit 0, the types are: Unknown, No_Root_Dir, Removable, Fixed, Remote, CDROM, Ramdisk. The last bit is reserved for future drive types. For example, a setting of 0xDF (11011111) will enable Autorun on CDROMs only.

NoDriveAutoRun
This value specifies which drives, by drive letter, will have Autorun enabled or disabled. The first bit is drive A:, second is B: and so on. Once again, 0 enables and 1 disables. For example, a setting of 0xFFFFFFF7 (11111111111111111111111111110111) will enable Autorun for drive D: only.

Microsoft Windows autorun.inf Vulnerability

References:

• Q136214: How to Test Autorun.inf Files (Microsoft)