A Design Flaw in Windows Kernel API can Lead to privilege escalation

vendor:

Windows Kernel API

by:

Moti

7,2

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: Windows Kernel API

Affected Version From: Windows Vista/2008 6.1.6000 x32

Affected Version To: Windows 7/2008 R2 6.2.7600 x64

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2009

A Design Flaw in Windows Kernel API can Lead to privilege escalation

A design flaw in Windows Kernel API can lead to privilege escalation. After running the PoC, typing “whoami” in command prompt will show the escalated user credentials. All actions this PoC performs require only user privilege, but result in arbitrary kernel mode code execution due to the ambiguous design of RtlQueryRegistryValues. This design flaw exists in most versions of Windows kernels, yet no patch or documentation is publicly available on this issue.

Mitigation:

No patch or documentation is publicly available on this issue.

Source

Exploit-DB raw data:

A Design Flaw in Windows Kernel API can Lead to privilege escalation.

Mirror of Original Post: http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/

PoC: http://www.codeproject.com/KB/vista-security/uac.aspx (not available)
mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15609.zip (uacpoc.zip)

After running this PoC, just type “whoami” in command prompt to see the escalated user credentials.
Points of Interest

All actions this PoC performs require only user privilege, but result in arbitrary kernel mode code execution due to the ambiguous design of RtlQueryRegistryValues. This design flaw exists in most versions of Windows kernels, yet no patch or documentation is publicly available on this issue.
Additional Information

This PoC may not correctly fix the exploited kernel context and resume execution without BSOD, such as on kernels ealier than 6.1.6000 are not supported, current supported kernels are:
Windows Vista/2008 6.1.6000 x32,
Windows Vista/2008 6.1.6001 x32,
Windows 7 6.2.7600 x32,
Windows 7/2008 R2 6.2.7600 x64.

Beyond this scope you may contact me for information on how to tune the code to work correctly on your kernel or how the shellcode works, etc. Those contents are beyond the scope of this article and of no importance to the exploit, therefore it is not included.