[Wintercore Research WS02-0209] Kaspersky Products Klim5.sys local privilege escalation
[ HTML VERSION ] http://www.wintercore.com/advisories/advisory_W020209.html
[ exploit code ]
http://kartoffel.reversemode.com/downloads.php
Background
Non-technical description
Technical Description
Exploiting it
References
Products Affected
Credits
Disclosure Timeline
Contact
1. Background
Founded in 1997, Kaspersky Lab is an international information security
software vendor. Kaspersky Lab is headquartered in Moscow, Russia and
has regional offices in the UK, France, Germany, the Netherlands,
Poland, Japan, China, Korea, Romania and the United States. Further
expanding the company's reach is its large partner network comprising
over 500 companies globally.
2. Non-technical description
Klim5.sys is prone to a local privilege escalation due to invalid
user-supplied buffer checking.
A local attacker can take advantage of this vulnerability to elevate
privileges from Guest account to SYSTEM.
3. Technical Description.
This driver is in charge of intercepting when a packet arrives or is
sent. (Un)fortunately a simple user-mode program can modify some
callbacks in klim5.sys to point to a user-mode controlled address, just
by sending a specially crafted IOCTL request.So... we face a local
privilege escalation.Again.
.text:00011774 cmp ecx, 80052110h ; IOCTL
.text:0001177A jnz short loc_117E9
.text:0001177C cmp ebp, 10h
.text:0001177F jnb short loc_1178E ; FLAW
.text:00011781 push 10h
.text:00011783 mov [esp+14h+Irp], 0C0000023h
.text:0001178B pop ebx
.text:0001178C jmp short loc_117E9
.text:0001178E ;
---------------------------------------------------------------------------
.text:0001178E
.text:0001178E loc_1178E: ; CODE XREF: sub_11730+4Fj
.text:0001178E push offset SpinLock ; SpinLock
.text:00011793 push offset dword_140A8 ; int
.text:00011798 push edi ; int
.text:00011799 call sub_11604 ; Flaw
.text:0001179E add edi, 8
.text:000117A1 push offset dword_140B8 ; SpinLock
.text:000117A6 or eax, 0FFFFFFFFh
.text:000117A9 sub eax, [edi]
.text:000117AB push offset dword_140B0 ; int
.text:000117B0 push edi ; int
.text:000117B1 mov [edi], eax
.text:000117B3 call sub_11604
and finally
.text:000115CB push [ebp+arg_0]
.text:000115CE call dword ptr [edi+8] ; Controlled
4. Exploiting it.
What it is interesting in this flaw is the way of exploiting it. NDIS
calls are "context-free" by definition, so when a packet arrives or is
sent, the NDIS call can be invoked in an arbitrary thread context.
Therefore, the callback we are modifying could be invoked in any other
thread than ours. There is an intrinsic race condition in the exploit.
Let's imagine a scenario where the exploit modifies the callback to
point to the address of its shellcode at 0x401000. However,before the
callback reachs our code in the exploit's context, another thread
triggers the callback and therefore, that address can contain anything,
note that also the memory referenced must be paged in since the callback
is dispatched at DISPATCH_LEVEL. To solve this scenario we must follow
the steps below:
+ Boost the priority of our exploit process/thread
+ Search common bytes in ring3 which are being shared by all the
processes,the modify them(in the exploit's context) to point to our
shellcode whilst in other processes that same address should point to a
"ret 4" instruction. (NtDeleteKey+n).
+ The shellcode must modify the callbacks to point to a "ret 4" address
that can be accessed in Ring0(ExGetSharedWaitersCount+n). While running
the exploit
[IMAGES]
5. References
http://www.reversemode.com/index.php?option=com_content&task=view&id=60&Itemid=1
6. Products Affected
Kaspersky AV 2008
Kaspersky AV for WorkStations 6.0
7. Credits
Vulnerability discovered and researched by Ruben Santamarta, Wintercore.
--
Wintercore
C/ Isla de Salvora, 180.
28400 Collado Villalba.
Spain
Phone: +(34) 91 849 98 89
www.wintercore.com