A view into ALPC-RPC Introduction ALPC RPC A view into ALPC-RPC UAC Advanced features & vulnerability research Clément Rouault & Thomas Imbert CVE-2017-11783 PacSec Conclusion November 2017 Clément Rouault & Thomas Imbert PacSec
Agenda A view into ALPC-RPC Introduction ALPC RPC UAC ALPC Advanced features & vulnerability RPC research UAC CVE-2017-11783 Conclusion Advanced features & vulnerability research CVE-2017-11783 Clément Rouault & Thomas Imbert PacSec
Agenda A view into ALPC-RPC Introduction ALPC RPC UAC Introduction 1 Advanced features & vulnerability research CVE-2017-11783 Conclusion Clément Rouault & Thomas Imbert PacSec
Where does this talk come from ? A view into ALPC-RPC Introduction ALPC User Account Control RPC We were curious about the UAC. UAC Advanced features Only API we found was ShellExecuteA & vulnerability research How to trigger the UAC manually ? CVE-2017-11783 We knew that UAC may be triggered by RPC Conclusion We knew that ALPC allows to perform RPC So let’s explore the RPC-over-ALPC ! Clément Rouault & Thomas Imbert PacSec
Existing research A view into ALPC-RPC Introduction ALPC Talks RPC LPC & ALPC Interfaces - Recon 2008 - Thomas Garnier UAC Advanced features All about the ALPC, RPC, LPC, LRPC in your PC - & vulnerability research Syscan 2014 - Alex Ionescu CVE-2017-11783 ALPC Fuzzing Toolkit - HITB 2014 - Ben Nagy Conclusion Tool RpcView (Jean-Marie Borello, Julien Boutet, Jeremy Bouetard, Yoanne Girardin) Clément Rouault & Thomas Imbert PacSec
Agenda A view into ALPC-RPC Introduction ALPC RPC UAC ALPC 2 Advanced features & vulnerability research CVE-2017-11783 Conclusion Clément Rouault & Thomas Imbert PacSec
Overview A view into ALPC-RPC Introduction ALPC ALPC RPC A dvanced L ocal P rocedure C all UAC Server listening on an ALPC Port Advanced features & vulnerability Client connecting to that port research CVE-2017-11783 ALPC Message Conclusion An ALPC message is composed of two parts PORT_MESSAGE : The header and data of the message ALPC_MESSAGE_ATTRIBUTES : Attributes header and data for advanced features Clément Rouault & Thomas Imbert PacSec
PORT_MESSAGE A view into ALPC-RPC Introduction 0:000> dt -r combase!_PORT_MESSAGE +0x000 u1 ALPC +0x000 s1 RPC +0x000 DataLength : Int2B // Size of DATA without header UAC +0x002 TotalLength : Int2B // Size of header + DATA +0x000 Length : Uint4B Advanced features & vulnerability +0x004 u2 research +0x000 s2 CVE-2017-11783 +0x000 Type : Int2B // Message Type +0x002 DataInfoOffset : Int2B Conclusion +0x000 ZeroInit : Uint4B 0x008 ClientId : _CLIENT_ID +0x000 UniqueProcess : Ptr32 Void // Identify the client +0x004 UniqueThread : Ptr32 Void // Identify the client +0x008 DoNotUseThisField : Float +0x010 MessageId : Uint4B // Identify msg for reply +0x014 ClientViewSize : Uint4B +0x014 CallbackId : Uint4B Clément Rouault & Thomas Imbert PacSec
APIs A view into ALPC-RPC Introduction Server ALPC NtAlpcCreatePort RPC UAC NtAlpcAcceptConnectPort Advanced features NtAlpcSendWaitReceivePort & vulnerability research TpCallbackSendAlpcMessageOnCompletion CVE-2017-11783 Used by rpcrt4.dll Conclusion Client NtAlpcConnectPort NtAlpcDisconnectPort NtAlpcSendWaitReceivePort Clément Rouault & Thomas Imbert PacSec
Python implementation import windows # https://github.com/hakril/PythonForWindows A view into ALPC-RPC def alpc_server(): server = windows.alpc.AlpcServer(PORT_NAME) Introduction msg = server.recv() # Wait for a connection message assert msg.type & 0xfff == LPC_CONNECTION_REQUEST ALPC server.accept_connection(msg) RPC msg = server.recv() # Wait for a real message UAC print("[SERV] Received message: <{0}>".format(msg)) print("[SERV] Message data: <{0}>".format(msg.data)) Advanced features & vulnerability assert msg.type & 0xfff == LPC_REQUEST research msg.data = "REQUEST ’{0}’ DONE".format(msg.data) CVE-2017-11783 server.send(msg) # Reply as we kept the same MessageId Conclusion def alpc_client(): client = windows.alpc.AlpcClient(PORT_NAME) print("[CLIENT] Connected: {0}".format(client)) response = client.send_receive("Hello world !") print("[CLIENT] Response: <{0}>".format(response.data)) Clément Rouault & Thomas Imbert PacSec
Agenda A view into ALPC-RPC Introduction ALPC RPC RPC Bind RPC 3 RPC call EpMapper RPC Bind UAC RPC call Advanced features EpMapper & vulnerability research CVE-2017-11783 Conclusion Clément Rouault & Thomas Imbert PacSec
Overview A view into ALPC-RPC Introduction R emote P rocedure C all ALPC RPC Server RPC Bind RPC call EpMapper One or many endpoints UAC One or many interfaces Advanced features & vulnerability Each interface has methods research CVE-2017-11783 Endpoints Conclusion ncacn_ip_tcp : IP + port ncacn_np : \pipe\my_endpoint ncalrpc : \RPC Control\my_alpc_port ... Clément Rouault & Thomas Imbert PacSec
RpcView A view into ALPC-RPC Introduction ALPC RPC RPC Bind RPC call EpMapper UAC Advanced features & vulnerability research CVE-2017-11783 Conclusion Clément Rouault & Thomas Imbert PacSec
RPC call steps A view into ALPC-RPC Introduction ALPC RPC RPC Bind RPC call EpMapper UAC Advanced features & vulnerability research CVE-2017-11783 Conclusion Clément Rouault & Thomas Imbert PacSec
RpcBindRequest A view into ALPC-RPC class ALPC_RPC_BIND(ctypes.Structure): Introduction _pack_ = 1 _fields_ = [ ALPC ("request_type", gdef.DWORD), RPC ("UNK1", gdef.DWORD), RPC Bind ("UNK2", gdef.DWORD), RPC call EpMapper ("target", gdef.RPC_IF_ID), # Interface GUID + Version UAC ("flags", gdef.DWORD), # Bind to NDR32 | NDR64 | ?? ("if_nb_ndr32", gdef.USHORT), # If number for NDR32 Advanced features ("if_nb_ndr64", gdef.USHORT), & vulnerability research ("if_nb_unkn", gdef.USHORT), ("PAD", gdef.USHORT), CVE-2017-11783 ("register_multiple_syntax", gdef.DWORD), Conclusion ("use_flow", gdef.DWORD), ("UNK5", gdef.DWORD), ("maybe_flow_id", gdef.DWORD), ("UNK7", gdef.DWORD), ("some_context_id", gdef.DWORD), ("UNK9", gdef.DWORD), ] Clément Rouault & Thomas Imbert PacSec
Build a minimal request & reponse A view into ALPC-RPC request Introduction ALPC req = ALPC_RPC_BIND() RPC req.request_type = gdef.RPC_REQUEST_TYPE_BIND RPC Bind req.target = gdef.RPC_IF_ID(uuid, *syntaxversion) RPC call req.flags = gdef.BIND_IF_SYNTAX_NDR32 EpMapper req.if_nb_ndr32 = requested_if_nb UAC req.if_nb_ndr64 = 0 Advanced features req.if_nb_unkn = 0 & vulnerability req.register_multiple_syntax = False research CVE-2017-11783 Response Conclusion Also a ALPC_RPC_BIND request_type == RPC_RESPONSE_TYPE_BIND_OK(1) Some fields may change to reflect the request actually handled by the server Clément Rouault & Thomas Imbert PacSec
RpcCall A view into ALPC-RPC class ALPC_RPC_CALL(ctypes.Structure): Introduction _pack_ = 1 _fields_ = [ ALPC ("request_type", gdef.DWORD), RPC ("UNK1", gdef.DWORD), RPC Bind ("flags",gdef.DWORD), RPC call EpMapper ("request_id", gdef.DWORD), UAC ("if_nb", gdef.DWORD), ("method_offset", gdef.DWORD), Advanced features ("UNK2", gdef.DWORD), & vulnerability research ("UNK3", gdef.DWORD), ("UNK4", gdef.DWORD), CVE-2017-11783 ("UNK5", gdef.DWORD), Conclusion ("UNK6", gdef.DWORD), ("UNK7", gdef.DWORD), ("UNK8", gdef.DWORD), ("UNK9", gdef.DWORD), ("UNK10", gdef.DWORD), ("UNK11", gdef.DWORD), ] Clément Rouault & Thomas Imbert PacSec
Build a minimal RPC Call A view into ALPC-RPC Introduction ALPC RPC req = ALPC_RPC_CALL() RPC Bind req.request_type = gdef.RPC_REQUEST_TYPE_CALL RPC call req.flags = 0 EpMapper req.request_id = 0x11223344 UAC req.if_nb = interface_nb Advanced features req.method_offset = method_offset & vulnerability return buffer(req)[:] + params research CVE-2017-11783 A lot of fields are not identified yet Conclusion params is the marshalling of the method parameters Clément Rouault & Thomas Imbert PacSec
N etwork D ata R epresentation (NDR) A view into ALPC-RPC N etwork D ata R epresentation (NDR) Introduction "The role of NDR is to provide a mapping of IDL ALPC data types onto octet streams" RPC RPC Bind Documented: http://pubs.opengroup.org/ RPC call EpMapper onlinepubs/9629399/chap14.htm UAC Advanced features Microsoft Transfert Syntax & vulnerability research 71710533-BEBA-4937-8319-B5DBEF9CCC36 v1.0 NDR CVE-2017-11783 Conclusion 8A885D04-1CEB-11C9-9FE8-08002B104860 v2.0 NDR64 B4537DA9-3D03-4F6B-B594-52B2874EE9D0 v1.0 ??? Please tell us if you find out this one :) We implemented part of NDR32 in Python for this project Clément Rouault & Thomas Imbert PacSec
Recommend
More recommend
