{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/118","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/118/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/118/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/118/events","html_url":"https://github.com/chrsmith/google-security-research/issues/118","id":58936753,"number":118,"title":"Windows: Elevation of Privilege in ahcache.sys/NtApphelpCacheControl","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CCProjectZeroMembers","name":"CCProjectZeroMembers","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CVE-2015-0002","name":"CVE-2015-0002","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-Exceeded","name":"Deadline-Exceeded","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-forshaw","name":"Finder-forshaw","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Fixed-2015-Jan-13","name":"Fixed-2015-Jan-13","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/MSRC-20544","name":"MSRC-20544","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-Windows-Kernel","name":"Product-Windows-Kernel","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/PublicOn-2014-Dec-29","name":"PublicOn-2014-Dec-29","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Sep-30","name":"Reported-2014-Sep-30","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-High","name":"Severity-High","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Vendor-Microsoft","name":"Vendor-Microsoft","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":49,"created_at":"2015-02-25T17:15:13Z","updated_at":"2015-02-25T17:15:25Z","closed_at":"2015-02-25T17:15:14Z","body":"```\nPlatform: Windows 8.1 Update 32/64 bit (No other OS tested)\n\nOn Windows 8.1 update the system call NtApphelpCacheControl (the code is \nactually in ahcache.sys) allows application compatibility data to be cached for \nquick reuse when new processes are created. A normal user can query the cache \nbut cannot add new cached entries as the operation is restricted to \nadministrators. This is checked in the function AhcVerifyAdminContext.\n\nThis function has a vulnerability where it doesn't correctly check the \nimpersonation token of the caller to determine if the user is an administrator. \nIt reads the caller's impersonation token using PsReferenceImpersonationToken \nand then does a comparison between the user SID in the token to LocalSystem's \nSID. It doesn't check the impersonation level of the token so it's possible to \nget an identify token on your thread from a local system process and bypass \nthis check. For this purpose the PoC abuses the BITS service and COM to get the \nimpersonation token but there are probably other ways. \n\nIt is just then a case of finding a way to exploit the vulnerability. In the \nPoC a cache entry is made for an UAC auto-elevate executable (say \nComputerDefaults.exe) and sets up the cache to point to the app compat entry \nfor regsvr32 which forces a RedirectExe shim to reload regsvr32.exe. However \nany executable could be used, the trick would be finding a suitable \npre-existing app compat configuration to abuse. \n\nIt's unclear if Windows 7 is vulnerable as the code path for update has a TCB \nprivilege check on it (although it looks like depending on the flags this might \nbe bypassable). No effort has been made to verify it on Windows 7. NOTE: This \nis not a bug in UAC, it is just using UAC auto elevation for demonstration \npurposes. \n\nThe PoC has been tested on Windows 8.1 update, both 32 bit and 64 bit versions. \nI'd recommend running on 32 bit just to be sure. To verify perform the \nfollowing steps:\n\n1) Put the AppCompatCache.exe and Testdll.dll on disk\n2) Ensure that UAC is enabled, the current user is a split-token admin and the \nUAC setting is the default (no prompt for specific executables). \n3) Execute AppCompatCache from the command prompt with the command line \n\"AppCompatCache.exe c:\\windows\\system32\\ComputerDefaults.exe testdll.dll\". \n4) If successful then the calculator should appear running as an administrator. \nIf it doesn't work first time (and you get the ComputerDefaults program) re-run \nthe exploit from 3, there seems to be a caching/timing issue sometimes on first \nrun. \n\nThis bug is subject to a 90 day disclosure deadline. If 90 days elapse\nwithout a broadly available patch, then the bug report will automatically\nbecome visible to the public.\n\n```\n\n-----\nOriginal issue reported on code.google.com by `fors...@google.com` on 30 Sep 2014 at 2:17\n\nAttachments:\n* [poc.zip](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-118/comment-0/poc.zip)\n"},"comment":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/comments/76006347","html_url":"https://github.com/chrsmith/google-security-research/issues/118#issuecomment-76006347","issue_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/118","id":76006347,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T17:15:25Z","updated_at":"2015-02-25T17:15:25Z","body":"```\nThis is a publicity stunt. It's a UAC bypass...not a priv esc exploit. UAC is \nnot security feature...and Microsoft has publicly stated that. Look at how long \nthey took to patch the original UAC bypass. This is just a publicity stunt to \nsay Google releases Windows 0day. \n```\n\n-----\nOriginal comment by `bon...@gmail.com` on 2 Jan 2015 at 8:34"}}