Date: Fri, 12 Mar 1999 13:03:57 -0700 From: Mark To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM Subject: [ ALERT ] Case Sensitivity and Symbolic Links Prasad Dabak of Cybermedia Software Private Limited has discovered yet another security risk in Windows NT involving the operating system's case sensitivity. According to the report, using the permissions on the "\??" object directory and by exploiting the case sensitivity of object manager, it is possible to trojan any system executables. Any ordinary user has write permissions on \?? Object directory. This is to allow user to map network drives or use "subst" utility to alias a directory to a new drive letter. Each system drive has an entry into \?? object directory. Each entry is actually a symbolic link which points to the device associated with that drive (ergo: Symbolic link \??\C: will typically point to a device such as \Device\HardDisk0\Partition1). It is possible to create a trojaned version of this symbolic link using the different character case -- for example, it is possible to create a symbolic link such as \??\c: (notice the small letter "c".) By doing this, all the requests to drive C get routed through the trojaned symbolic link. Please visit the following URL, where you'll find the further details along with links to a demonstration of the problem. http://www.ntsecurity.net/scripts/load.asp?iD=/security/casesensitive.htm Mark ---------------------------------------------------------------------------- Date: Sat, 13 Mar 1999 00:32:19 +0100 From: Alexandre Stervinou To: BUGTRAQ@netspace.org Subject: New Security Vulnerability in WinNT A new security vulnerability in Windows NT4 has been released, I was just surfin' on http://www.cybermedia.co.in/, when I saw this: CSPL has uncovered most serious Case Sensitivity vulnerability in Microsoft's Windows NT operating system. This security hole allows you to get "Administrator" access on a machine while logged in as "guest" or any ordinary user [...] Description: Using the permissions on the "\??" object directory and by exploiting the case sensitivity of object manager it is possible to trojan any system executables. -- Alexandre Stervinou mailto:stervino@info.enserb.u-bordeaux.fr ---------------------------------------------------------------------------- http://www.cybermedia.co.in/ Case Sensitivity vulnerability: Description: Using the permissions on the "\??" object directory and by exploiting the case sensitivity of object manager it is possible to trojan any system executables. Problem: Any ordinary user has write permissions on \?? Object directory. This is to allow user to map network drives or use "subst" utility to alias a directory to a new drive letter. Each drive on the system (let it be local/network/substed) has an entry into \?? object directory. Each entry is actually a symbolic link which points to the device associated with that drive. (e.g Symbolic link \??\C: will typically point to a device such as \Device\HardDisk0\Partition1). It is possible to create a trojaned version of this symbolic link using the different case. e.g it is possible to create a symbolic link such as \??\c: (notice the small letter ‘c’). By doing this, all the requests to drive C gets routed through the trojaned symbolic link. (e.g If you get the contents of symbolic link \??\D: and create a symbolic link say \??\c: and put those contents there, then executing dir command on drive C will give you directory listing for drive D). So effectively you can route the traffic on drive C to drive D. This is exactly what the simulation program exploits. Simulation: The description of simulation assumes that you have unzipped the files from the demo in a directory called C:\FOO and your Windows NT System directory is C:\WINNT\SYSTEM32. The simulation works on latest service packs of all Windows NT versions (3.51, 4.0, 5.0) When you execute BESYSADM.EXE. The program follows the following steps. Create an indentical directory structure of Windows system directory under the directory C:\FOO. i.e it will create a directory structure such as C:\FOO\WINNT\SYSTEM32 Copy all the POSIX subsystem binaries and required DLLs (except PSXSS.EXE) from C:\WINNT\SYSTEM32 directory to C:\FOO\WINNT\SYSTEM32 Copy the trojaned version of PSXSS.EXE and a dummy posix application DUMMYAPP.EXE from C:\FOO to C:\FOO\WINNT\SYSTEM32 Get the contents of the symbolic link \??\C: and append \FOO to it. i.e if the contents of symbolic link \??\C: is \Device\HardDisk0\Partition1 then new name formed will be \Device\HardDisk0\Partition1\FOO Create a symbolic link \??\c: (note small c) with the contents as \Device\HardDisk0\Partition1\FOO Hence effectively executing a dir command on drive C will now give directory listing of C:\FOO Next the program starts a posix application DUMMYAPP.EXE as "POSIX /c DUMMYAPP.EXE" This results in SMSS.EXE starting POSIX subsystem which effectively loads trojaned version of PSXSS.EXE. This trojaned version inherits security context of SMSS.EXE and hence our PSXSS.EXE runs in root privilege. This trojaned version adds the logged in user to the local administrator group. T The name of the logged in user is passed through a file called u.ini that is created in C:\FOO\WINNT directory. Comments The program actually uses \DosDevices everywhere instead of \??, since Windows NT 3.51 does not have \?? object directoy and has DosDevices object directory. Starting from Windows NT 4.0, \DosDevices is actually a symbolic link which points to \??. Hence using DosDevices allows the program to run on all Windows NT versions. Instructions for Demo Fresh boot the machine. Login as any ordinary user (guest will also do) Unzip the files in attached .ZIP file in some directory on any local hard drive on your machine Run BESYSADM.EXE Note: If you are using Non-English version of Windows NT OR name of the local administrator group is renamed, then specify the name of the local administrator group as a command line to BESYSADM.EXE. If no arguments are specified the program assumes that you are runnning on English version and the name of the local administrator group is "Administrators". ---------------------------------------------------------------------------- Date: Sat, 13 Mar 1999 01:07:18 -0800 From: Dominique Brezinski To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM Subject: Re: [ ALERT ] Case Sensitivity and Symbolic Links At 01:03 PM 3/12/99 -0700, Mark wrote: >Any ordinary user has write permissions on \?? Object directory. This is to >allow user to map network drives or use "subst" utility to alias a directory >to a new drive letter. Each system drive has an entry into \?? object >directory. Each entry is actually a symbolic link which points to the device >associated with that drive (ergo: Symbolic link \??\C: will typically point >to a device such as \Device\HardDisk0\Partition1). It is possible to create >a trojaned version of this symbolic link using the different character >case -- for example, it is possible to create a symbolic link such as \??\c: >(notice the small letter "c".) By doing this, all the requests to drive C >get routed through the trojaned symbolic link. Well, the exploit does not work on my machine--it fails with "Internal error..." when run in my test configuration. I am running NT 4.0 Workstation, SP4, ProtectionMode set to 1, file and registry permissions set to those recommended in Steve Sutton's NSA guide, Guest user enabled and allowed to log on locally, %SystemRoot% is on the C partition, and the exploit executables on the D partition (the only place writable by guest on my system). I enabled auditing on the \?? object and no access was attempted. So, it appears that something about my configuration stopped the exploit in its tracks ;) When I run it from an admin account, it returns a message saying that the account is already a member of the administrators group. Oh yeah, I had to enable the Posix subsystem too. As with the KnownDLLs exploit, good system administration should impede these kinds of exploits. Though, they are doing a good job of scratching the surface of huge classes of local privilege escalation attacks for NT. Dominique Brezinski CISSP (206) 898-8254 Secure Computing http://www.securecomputing.com