[原创]一次不完美的0day,使用全新的方式利用btis服务com组件漏洞,成功提权至system
我的poc能实现功能:需要管理员身份运行,在打满所有补丁的server2008或win7操作系统,能在bits服务上运行shellcode,最终获得一个system权限的cmd
我的poc实现原理:在windows下有个以system权限运行的Background Intelligent Transfer Service服务(简称bits),调用bits服务的公开api中的IBackgroundCopyJob->SetNotifyInterface接口,bits服务最终会调用loadregtypelib这个ole32下函数加载一个指定com组件的typelib(具体原理可参考CVE-2017-0213,这里省略),并且可以指定任意typlelib,loadregtypelib函数接着调用LoadTypeLibEx,具体可看我的逆向代码.
`HRESULT __stdcall LoadTypeLibEx(LPCOLESTR szFile, REGKIND regkind, ITypeLib **pptlib)
{
wchar_t *szFileNameRef; // edi
int hr; // esi
int v5; // esi
int v6; // eax
OLECHAR *v8; // edi
HRESULT stat; // esi
void *v10; // [esp+Ch] [ebp-898h]
ITypeLib **ptlibRef; // [esp+10h] [ebp-894h]
ULONG pchEaten; // [esp+14h] [ebp-890h]
LPMONIKER ppmk; // [esp+18h] [ebp-88Ch]
LPBC ppbc; // [esp+1Ch] [ebp-888h]
struct ILockBytes *v15; // [esp+20h] [ebp-884h]
ITypeLib *ptlib; // [esp+24h] [ebp-880h]
LPCOLESTR szFullPath; // [esp+28h] [ebp-87Ch]
HFILE hFile; // [esp+2Ch] [ebp-878h]
int v19; // [esp+30h] [ebp-874h]
int v20; // [esp+38h] [ebp-86Ch]
int v21; // [esp+3Ch] [ebp-868h]
int v22; // [esp+40h] [ebp-864h]
struct _IMAGE_DOS_HEADER v23; // [esp+48h] [ebp-85Ch]
enum tagSYSKIND syskind; // [esp+88h] [ebp-81Ch]
int v25; // [esp+8Ch] [ebp-818h]
wchar_t Filename; // [esp+90h] [ebp-814h]
wchar_t Dir; // [esp+290h] [ebp-614h]
wchar_t PathResult; // [esp+490h] [ebp-414h]
wchar_t Ext; // [esp+698h] [ebp-20Ch]
wchar_t Drive; // [esp+898h] [ebp-Ch]
szFileNameRef = szFile;
ptlibRef = pptlib;
ppmk = 0;
if ( (regkind & 0x60) == 96 )
{
syskind = -1;
}
else if ( regkind & 0x20 )
{
syskind = 1;
}
else
{
syskind = (regkind & 0x40 | 0x20u) >> 5;
}
if ( regkind & 0xFFFFFF9F )
{
if ( (regkind & 0xFFFFFF9F) == 1 )
{
regkind = 1;
}
else if ( (regkind & 0xFFFFFF9F) == 2 )
{
regkind = 2;
}
}
else
{
regkind = 0;
}
if ( !szFile || !pptlib || regkind > 2 )
return -2147024809;
*pptlib = 0;
while ( 1 )
{
v15 = 0;
ptlib = 0;
InitLoadInfo(&szFullPath);
hr = InitAppData();
if ( hr < 0 )
goto LABEL_60;
if ( !*szFileNameRef )
{
hr = -2147287038;
goto LABEL_60;
}
v5 = sub_6FC41A75();
if ( v5 )
{
ptlib = OLE_TYPEMGR::LookupTypeLib(g_poletmgr, szFileNameRef, syskind);
if ( ptlib )
goto LABEL_31;
}
if ( FindTypeLib(szFileNameRef, &szFullPath, v5) )
{
if ( CreateBindCtx(1u, &ppbc) )
goto LABEL_67;
v8 = SysAllocString(szFileNameRef);
if ( v8 )
{
//先根据它的DisplayName创建filemoniker
stat = MkParseDisplayName(ppbc, v8, &pchEaten, &ppmk);
SysFreeString(v8);
if ( !stat )
{
//BindToObject调用来获取typelib
stat = ppmk->lpVtbl->BindToObject(ppmk, ppbc, 0, &IID_ITypeLib, &ptlib);
ppmk->lpVtbl->Release(ppmk);
}
}
else
{
stat = -2147024882;
}
ppbc->lpVtbl->Release(ppbc);
if ( stat )
{
LABEL_67:
hr = -2147312566;
goto LABEL_60;
}
goto LABEL_28;
}
ptlib = OLE_TYPEMGR::LookupTypeLib(g_poletmgr, szFullPath, syskind);
if ( ptlib )
{
UninitLoadInfo(&szFullPath);
LABEL_31:
*ptlibRef = ptlib;
return 0;
}
pchEaten = 0;
ppbc = 0;
if ( v22 )
{
hr = GetOffsetOfResource(hFile, "typelib", v21, &v23, &pchEaten, &ppbc);
if ( hr < 0 )
goto LABEL_60;
}
hr = CreateFileLockBytesOnHFILE(hFile, 0, pchEaten, ppbc, &v10, &v15);
if ( hr < 0 )
goto LABEL_60;
hFile = -1;
if ( v20 || v22 )
{
v6 = LoadTypeLib2LockBytes(v15, szFullPath, v25, v10, &ptlib, syskind);
hr = v6;
if ( v6 >= 0 )
{
if ( v15 )
{
v15->lpVtbl->Release(v15);
v15 = 0;
}
goto LABEL_24;
}
if ( v6 != -2147319783 )
goto LABEL_60;
}
if ( syskind != 3 )
break;
if ( ppmk
|| (_wsplitpath_s(szFileNameRef, &Drive, 3u, &Dir, 0x100u, &Filename, 0x100u, &Ext, 0x100u),
_wcsicmp(&Filename, L"stdole32"))
|| _wcsicmp(&Ext, L".tlb") )
{
hr = -2147319783;
goto LABEL_60;
}
_wmakepath_s(&PathResult, 0x104u, &Drive, &Dir, L"stdole2", &Ext);
if ( v15 )
v15->lpVtbl->Release(v15);
UninitLoadInfo(&szFullPath);
szFileNameRef = &PathResult;
ppmk = 1;
}
hr = LoadTypeLib1LockBytes(&v15, szFullPath, v25, &ptlib);
if ( hr >= 0 )
{
LABEL_24:
hr = OLE_TYPEMGR::TypeLibLoaded(g_poletmgr, szFullPath, v25, ptlib, syskind);
if ( hr < 0 )
goto LABEL_60;
if ( regkind == REGKIND_DEFAULT && v19 || regkind == 1 )
RegisterTypeLib(ptlib, szFullPath, 0);
LABEL_28:
UninitLoadInfo(&szFullPath);
*ptlibRef = ptlib;
return 0;
}
LABEL_60:
if ( ptlib )
ptlib->lpVtbl->Release(ptlib);
if ( v15 )
v15->lpVtbl->Release(v15);
UninitLoadInfo(&szFullPath);
return hr;
}`;
注意：上传附件及图片大小不得大于30M。
⚠️ 版权声明：
本博客所有内容（含教程、源码、工具）仅供个人技术学习与研究交流使用，严禁商用、倒卖、二次分发及非法用途。
未经作者书面授权，任何组织或个人不得转载、复制或用于其他平台，违者将追究相关责任。
参与讨论
登录后可查看全部回复并参与讨论。
