RunAs Service Pipe Authentication Failure (exploit code)
20 Nov. 2001
Summary
The Windows 2000 RunAs service allows a user to launch an application in a security context based upon a supplied set of credentials. If the service is ever in a stopped state, an arbitrary local user of the system has the ability to recover the RunAs service user's plaintext credentials. Additionally, the user may also impersonate the credentials the clients of the RunAs service.
The Windows 2000 API CreateProcessWithLogonW leverages the RunAs service to authenticate and launch an application requested by the user, in a distinct security context, based on the credentials supplied. Consequently, that API must send highly sensitive data to the RunAs service in order to launch that application. However, that API performs no server-side authenticity validation prior to sending the credentials.
If the RunAs service is ever in a stopped state, an arbitrary user may usurp its named pipe communication channel "\\.\pipe\secondarylogon". The user's malicious application would then be capable of stealing credentials of the users of the RunAs service, because the credentials are sent in plaintext. Additionally, the application is capable of impersonating the clients' security context throughout the system in an effort to escalate privileges.
In light of issues such as these, Microsoft created the native API NtSecureConnectPort for sending highly sensitive data via the LPC subsystem. Unfortunately, there is no standard API, provided by Microsoft, for deterministically connecting to a pipe based on a supplied SID.
Exploit code:
// radix1112200101.c - Camisade - Team RADIX - 11-12-2001
//
// Camisade (www.camisade.com) is not responsible for the use or
// misuse of this proof of concept source code.
