05-26, 10:20–11:00 (Europe/Stockholm), Main stage
The C:\Windows\Temp directory may seem like a safe place to store temporary data, but it has a few quirks that not all developers are aware of. For code running with high privileges, like Windows services, it becomes an attack surface. For attackers it is the gift that keeps on giving by exposing products to privilege escalation vulnerabilities.
The talk covers (now fixed) privilege escalation vulnerabilities in Snow Inventory Agent for Windows (CVE-2018-17778) and F5 BigIP Edge Client for Windows (CVE-2021-23022). They share a common theme in that they both use C:\Windows\Temp in an insecure way
This talk will cover the discovery and exploit development of the vulnerabilities. They are all caused by misconceptions and logic bugs when interacting with C:\Windows\Temp, no memory corruption involved at all. There is definitely lessons to be learned in product vulnerability management here, as both software vendors failed one attempt to release a version of the product that fixed the identified issues.
I will briefly go through some Windows exploit primitives such DLL-hijacking, named pipes, oplocks and directory junctions, as well as a new(?) technique of bypassing TOCTOC of multiple "checks" using a combination of directory junctions and oplocks.
Example of contents covered:
Snow Inventory Agent for Windows (CVE-2018-17778)
1. Vulnerability discovery (driver loaded from insecure location).
2. Verifying the vulnerability.
3. Exploiting the vulnerability using BYOVD (Bring You Own Vulnerable Driver).
F5 BigIP Edge Client for Windows (CVE-2021-23022)
1. Verifying an N-day vulnerability (CVE-2020-5896).
2. Exploiting N-day with DLL-hijacking.
3. Evaluating the fix.
4. Bypassing code signatures on CAB files.
5. Executing code using backdoored CAB files.
6. Executing code using oplocks and DLL-hijacking.
7. Evaluating the fix of the fix.
8. Bypassing the fix of the fix.
9. Evaluating the fix of the fix of the fix.
Jonas is a senior security consultant at Sentor since 2013, securing the world one reverse shell at a time. Enjoys coffee, coding, bypassing EDRs, Windows privilege escalation bugs and getting Domain Admin.