Windows 10: 2 Steps Forward, 1 Step Back by James Forshaw

1. Windows 10
2 Steps Forward,
1 Step Back
James Forshaw @tiraniddo
44con 2015
1

2. James Forshaw @tiraniddo
Obligatory Background Slide
2
● Researcher in Google’s Project Zero team
● Specialize in Windows
○ Especially local privilege escalation
● Never met a logical vulnerability I didn’t like

3. James Forshaw @tiraniddo
What I’m Going to Talk About
● Some research on Windows 10 from the early preview builds
● Why Windows 10 is awesome for security
● Except for when it isn’t!
● Very much looking at things from a local privilege escalation
perspective
3

4. James Forshaw @tiraniddo
Windows 10
4

5. James Forshaw @tiraniddo
Windows Local Attack Surface
5

6. James Forshaw @tiraniddo
Local System Vulnerabilities are Dead!
6
#opfreecalc

7. James Forshaw @tiraniddo
System Services and Drivers
7
Windows 7 SP1 Windows 8.1 Windows 10
Services 150 169 196
Drivers 238 253 291
7 8 10

8. James Forshaw @tiraniddo
Service Privilege Levels
8
Windows 7 SP1 Windows 8.1 Windows 10
Local System 53.69% 56.89% 61.14%
Local Service 32.21% 31.14% 28.50%
Network Service 14.09% 11.98% 10.36%
7 8 10

9. James Forshaw @tiraniddo
SVCHOST Running as User?
9
Malware?
Nope!

10. James Forshaw @tiraniddo
Service Start Mode
10
Windows 7 Windows 8.1 Windows 10
Auto 30.07% 26.19% 24.10%
Disabled 5.23% 3.57% 2.05%
Manual 53.59% 43.45% 42.56%
Triggered 11.11% 26.79% 31.28%
7 8 10

11. James Forshaw @tiraniddo
Accessible Device Objects
11
7 8 10
Windows 7 Windows 8.1 Windows 10
Read/Write 64 54 52
Read-Only 6 6 5

12. James Forshaw @tiraniddo
Isolated User Mode
12

13. James Forshaw @tiraniddo
Isolated LSASS
13
Image from http://deploymentresearch.com/Research/Post/490/Enabling-Virtual-Secure-Mode-VSM-in-Windows-10-Enterprise-Build-10130

14. James Forshaw @tiraniddo
But Sadly
● Not available in consumer builds only Enterprise
● Can’t use your own code to isolate anything
● Very restrictive use
14

15. James Forshaw @tiraniddo
Edge Browser
15

16. James Forshaw @tiraniddo
Microsoft Edge Security
16
ActiveX is
gone(ish)
AppContainer Sandbox Always On

17. James Forshaw @tiraniddo
Microsoft Edge and Flash
17
Nope!

18. James Forshaw @tiraniddo
Has No One Learnt from the Past?
18

19. James Forshaw @tiraniddo
Guess Trident Wasn’t a Suitable Base?
19

20. James Forshaw @tiraniddo
User Account Control
20

21. James Forshaw @tiraniddo
They’ve Fixed Some Bugs I’ve Reported
21
https://code.google.com/p/google-security-research/issues/detail?id=156
https://code.google.com/p/google-security-research/issues/detail?id=220

22. James Forshaw @tiraniddo
UAC Auto Elevation Directory Check
22
c:windows c:windowstracingapp.exe app.exe
ALLOWED BANNED

23. James Forshaw @tiraniddo
Folder Permissions
23
c:windows c:windowstracingapp.exe app.exe
ALLOWED BANNED

24. James Forshaw @tiraniddo
AiCheckSecureApplicationDirectory Bypass
24
● Need to be able to write a file with a secure path
● How can we write to C:Windows without writing to C:Windows?
c:windows malicious.exe
ALLOWED
c:windows ????
ALLOWED?

25. James Forshaw @tiraniddo
NTFS Alternate Data Streams FTW!
25
c:windows tracing:malicious.exe
ALLOWED
● Only need FILE_WRITE_DATA/FILE_ADD_FILE access right on
directory to created named stream.

26. James Forshaw @tiraniddo
Didn’t Fix All my UAC Bypasses Though
26
https://code.google.com/p/google-security-research/issues/detail?id=219

27. James Forshaw @tiraniddo
DEMO
Elevated Token Capture
27

28. James Forshaw @tiraniddo 28
Well MS Almost Did
If Token Level
< Impersonate
If Process has
Impersonate
Privilege
ALLOWED
Restrict to
Identification
Level
If Process IL <
Token IL
If Process User
== Token User
Elevation
Check

29. James Forshaw @tiraniddo
Elevated Token Impersonation
● Blocks impersonating an elevated token unless process token is
also elevated
● Must be enabled in SeCompatFlags kernel flag
29
if (SeTokenIsElevated(ImpersonationToken)) {
if ((SeCompatFlags & 1)
&& !SeTokenIsElevated(ProcessToken)) {
return STATUS_PRIVILEGE_NOT_HELD;
}
}

30. James Forshaw @tiraniddo
In The End Still the “Wrong” Default IMO!
30

31. James Forshaw @tiraniddo
If You Change Task Manager Needs a Prompt
31

32. James Forshaw @tiraniddo
Windows Symbolic Links
32
Windows NT 3.1 - July 27 1993
Object Manager Symbolic Links
Registry Key Symbolic Links
Windows 2000 - Feb 17 2000
NTFS Mount Points and
Directory Junctions
Windows Vista - Nov 30 2006
NTFS Symbolic Links

33. James Forshaw @tiraniddo
Mitigated in Sandboxes
33
NTFS Mount Points
Registry Key Symbolic
Links
Object Manager
Symbolic Links
BANNED
LIMITED
LIMITED

34. James Forshaw @tiraniddo
Mitigations Backported
34

35. James Forshaw @tiraniddo
DEMO
NTFS Mount Point Mitigation Bypass
35

36. James Forshaw @tiraniddo
Win32k Hardening
36

37. James Forshaw @tiraniddo
Fonts Are Bad
37

38. James Forshaw @tiraniddo
Making it Less Bad
User Mode Font Driver
38
Disable Custom Font Policy
(undocumented)
PROCESS_MITIGATION_FONT_DISABLE_POLICY
policy = { 0 };
policy.DisableNonSystemFonts = 1;
policy.AuditNonSystemFontLoading = 1;
SetProcessMitigationPolicy(
ProcessFontDisablePolicy,
&policy,
sizeof(policy));

39. James Forshaw @tiraniddo
User Mode Font Driver
Only SYSTEM can open process?Running as user in AppContainer
39

40. James Forshaw @tiraniddo
Process Token Default DACL
After September Patch
40
Before September Patch

41. James Forshaw @tiraniddo
Thread DACLs Allow User Access
41

42. James Forshaw @tiraniddo
Extra, UMFD Only Win32k Escape Calls
42
NtGdiEscape Command UMFD Escape Call
13 UmfdEscEngGetFileChangeTime
14 UmfdEscEngGetFilePath
15 UmfdEscEngComputeGlyphSet
16 UmfdEscEngCreateFile
17 UmfdEscParseFontResources
18 atmfdFontManagement (enable kernel ATMFD driver)
And Others ...

43. James Forshaw @tiraniddo
UmfdEscEngCreateFile in Win32kFull.sys
// Name is only SystemRootSystem32FAC.ATM
HANDLE EngCreateFile(UNICODE_STRING Name) {
ACCESS_MASK Access = FILE_GENERIC_READ;
OBJECT_ATTRIBUTES Attrs;
HANDLE Handle = -1;
ULONG Disposition = FILE_OPEN;
InitializeObjectAttributes(&Attrs, &Name,
OBJ_CASE_INSENSITIVE, ...);
IoCreateFile(&FileHandle, FILE_GENERIC_READ,
&Attrs, ..., FILE_OPEN, ...,
IO_FORCE_ACCESS_CHECK);
return FileHandle;
}
43
// Name is SystemRootSystem32QLCLF.ATM,
// ATMLIB.DLL or FAC.ATM
HANDLE EngCreateFile(UNICODE_STRING Name,
BOOL ReadOnly) {
ACCESS_MASK Access = FILE_GENERIC_READ;
OBJECT_ATTRIBUTES Attrs;
HANDLE Handle = -1;
ULONG Disposition = FILE_OPEN;
if (!ReadOnly) {
Access |= FILE_WRITE_DATA;
Disposition = FILE_OPEN_IF;
}
InitializeObjectAttributes(&Attrs, &Name,
OBJ_CASE_INSENSITIVE,
...);
ZwCreateFile(&FileHandle, Access, &Attrs, ...,
Disposition, ...);
return FileHandle;
}
Before September Patch After September Patch

44. James Forshaw @tiraniddo
UmfdEscEngCreateFile in Win32kFull.sys
// Name is only SystemRootSystem32FAC.ATM
HANDLE EngCreateFile(UNICODE_STRING Name) {
ACCESS_MASK Access = FILE_GENERIC_READ;
OBJECT_ATTRIBUTES Attrs;
HANDLE Handle = -1;
ULONG Disposition = FILE_OPEN;
InitializeObjectAttributes(&Attrs, &Name,
OBJ_CASE_INSENSITIVE, ...);
IoCreateFile(&FileHandle, FILE_GENERIC_READ,
&Attrs, ..., FILE_OPEN, ...,
IO_FORCE_ACCESS_CHECK);
return FileHandle;
}
44
// Name is SystemRootSystem32QLCLF.ATM,
// ATMLIB.DLL or FAC.ATM
HANDLE EngCreateFile(UNICODE_STRING Name,
BOOL ReadOnly) {
ACCESS_MASK Access = FILE_GENERIC_READ;
OBJECT_ATTRIBUTES Attrs;
HANDLE Handle = -1;
ULONG Disposition = FILE_OPEN;
if (!ReadOnly) {
Access |= FILE_WRITE_DATA;
Disposition = FILE_OPEN_IF;
}
InitializeObjectAttributes(&Attrs, &Name,
OBJ_CASE_INSENSITIVE,
...);
ZwCreateFile(&FileHandle, Access, &Attrs, ...,
Disposition, ...);
return FileHandle;
}
Before September Patch After September Patch
Attacker
Controlled
No Security Check All Gone

45. James Forshaw @tiraniddo
Process Silos
● New process container mechanism
● Possibly related to docker support
● Works in a similar fashion to process jobs
45
NTSTATUS NtCreateSiloObject(
PHANDLE handle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes);

46. James Forshaw @tiraniddo
Opening Device Object
46
DeviceHarddisk1SomeName
DeviceHarddisk1 SomeName
Device Path
Native NT Path
Device
Namespace Path
Harddisk Driver
Create File
Handler
Driver Responsible for
Security

47. James Forshaw @tiraniddo
Replace the Root Object Directory
47
// Create anonymous directory object
InitializeObjectAttributes(&ObjectAttributes,
NULL, 0, NULL, NULL);
NtCreateDirectoryObject(&hDir, &ObjectAttributes, ...);
NtSetInformationSiloObject(hSilo, SiloObjectRootDirectory,
&hDir, sizeof(hDir));
NtAssignProcessToSiloObject(hSilo, GetCurrentProcess());
// Process root directory now empty
Exploit: https://code.google.com/p/google-security-research/issues/detail?id=459

48. James Forshaw @tiraniddo
Fixed in RTM
● Silo functionality rolled into Job objects
● Changed object directory now behind a TCB check
● Shame for Chrome, would have been a useful feature
48

49. James Forshaw @tiraniddo
Public Service Announcement
Doing too much security
research on Beta software
can make you sad
49

50. James Forshaw @tiraniddo
(Dis)Honourable Mentions
Control Flow Guard (CFG)
Privacy Options
Cumulative Updates
Microsoft Cross-Signed Drivers
50

51. James Forshaw @tiraniddo
Conclusions
51
2 steps forward, 1 step back. Still plenty of things to attack!

52. James Forshaw @tiraniddo
DEMO
Local System Elevation
52

53. James Forshaw @tiraniddo
Good Old Issue 222
53
https://code.google.com/p/google-security-research/issues/detail?id=222

54. James Forshaw @tiraniddo
Questions?
54