Windows: DSSVC CanonicalAndValidateFilePath Security Feature Bypass
The Data Sharing Service’s check for the user passing UNC paths can be circumvented leading to a security feature bypass which can facilitate easier exploitation for privilege elevation. During DSSCreateSharedFileTokenEx, the path is passed to DSUtils::CanonicalAndValidateFilePath to canonicalize the path. This method also verifies that the passed path isn’t a UNC path (for reasons unknown). The UNC path check can be bypassed by using the ??UNC form. When this is passed to PathAllocCanonicalize, it returns it verbatim, however, this path format isn’t considered a UNC path by PathIsUNCEx. However, when passed to CreateFile, etc., it will be considered as if it was a ?UNC path format. This could be useful for a few different attacks. For a start, you could redirect the call to localhostpipesomepipe and get a named pipe handle bound to the SYSTEM user. Although I’ve not worked out a way of getting the handle back (as GetFinalPathFromHandle fails). Another attack vector is when going to an SMB share any directory junctions are resolved on the server, this would allow you to bypass any checks such as DSUtils::VerifyPathFromHandle as the returned path would be ?UNClocalhostc$blah.. Regardless of the final des
