Windows Vista: Non-privileged code can redirect shortcuts to intercept privilege elevation requests
Tested on x86 and x64 editions of Windows Vista Ultimate, though this exploit
should function correctly on all x86 and x64 editions of Windows Vista.
This exploit requires an attack vector such as a Trojan horse. However, in
light of the enormous success of such types of attacks in the past, and the
fact that User Account Control (UAC) would be expected to protect the user from
doing something particularly dangerous to the machine, this should be
considered exploitable.
Non-privileged code can be used to replace shortcuts on the Start Menu and
intercept elevation of privileges. Because of the way the Start Menu is
constructed, users can enumerate all of the shortcuts that appear on their
menus because they have read access to the folders where the shortcuts reside.
The Start Menu is composited of a common folder and the specific user's folder,
preferring the user folder if duplicates exist.
Using COM and the .NET Framework, a stub EXE generator can be created that will
check for the presence of privilege elevation before launching the original
target process (in order to not alert the user to the fact that the target is
infected). The .NET CLR is installed by default on Windows Vista and so can be
used as part of the attack vector.
The proof-of-concept enumerates the shortcuts on the user's menu and the common
menu and creates or modified user-local shortcuts to exploitable executables
via proxy EXEs. It generates the proxy executables and then writes a text file
to the Windows\System32 folder once a proxy executable has been run with
elevation. The proof-of-concept code is available at
http://www.robpaveza.net/VistaUACExploit/PoC.zip and requires Visual Studio
2005 to compile.
A whitepaper detailing the architecture of UAC and this exploit is also
available at http://www.robpaveza.net/VistaUACExploit/UACExploitWhitepaper.pdf.
The whitepaper details the implementation of the Proof of Concept as well, and
goes into significantly more detail than this (I'm sorry that this is short,
but I've been working on writing this up for quite a while and just want it to
be over).