|
CVE-2017-0213: Windows COM Privilege Escalation Vulnerability
A vulnerability was found by James Forshaw of Google Project Zero in January that exploits a bug in Windows COM Aggregate Marshaler that an attacker can use to elevate privileges. It gave Microsoft 90 days to patch, which they have with last month’s security updates.
To exploit the vulnerability, an attacker could run a specially crafted application that could exploit the vulnerability. This bug also has the potential to be an RCE if a COM client connects to an arbitrary server. The bug lies in the implementation of unpacking the results of the RQI2 request in CStdMarshal::Finish_RemQIAndUnmarshal2.
POC code is available that abuses the BITS SetNotifyInterface to get a type library loaded under impersonation, and causes it to load a type library which references a scriptlet moniker which gets us code execution inside the BITS service. The result is a new cmd window with system privileges.
You can directly download the x86 and x64 versions ::HERE:: or visit my pentesting wiki’s Windows Priv Escalation page
Windows versions affected:
· Microsoft Windows 10 Version 1607 for 32-bit Systems
· Microsoft Windows 10 Version 1607 for x64-based Systems
· Microsoft Windows 10 for 32-bit Systems
· Microsoft Windows 10 for x64-based Systems
· Microsoft Windows 10 version 1511 for 32-bit Systems
· Microsoft Windows 10 version 1511 for x64-based Systems
· Microsoft Windows 10 version 1703 for 32-bit Systems
· Microsoft Windows 10 version 1703 for x64-based Systems
· Microsoft Windows 7 for 32-bit Systems SP1
· Microsoft Windows 7 for x64-based Systems SP1
· Microsoft Windows 8.1 for 32-bit Systems
· Microsoft Windows 8.1 for x64-based Systems
· Microsoft Windows RT 8.1
· Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1
· Microsoft Windows Server 2008 R2 for x64-based Systems SP1
· Microsoft Windows Server 2008 for 32-bit Systems SP2
· Microsoft Windows Server 2008 for Itanium-based Systems SP2
· Microsoft Windows Server 2008 for x64-based Systems SP2
· Microsoft Windows Server 2012
· Microsoft Windows Server 2012 R2
· Microsoft Windows Server 2016
Mitigation:
Update your version of Windows with available automatic updates. More info: https://support.microsoft.com/en-us/help/20170509
Demo: https://www.youtube.com/embed/2rkAZJ-E_ZU?ecver=2
