CVE-2023-29343 PoC — Microsoft SysInternals 安全漏洞

Source

https://github.com/Wh04m1001/CVE-2023-29343

Associated Vulnerability

Title:Microsoft SysInternals 安全漏洞 (CVE-2023-29343)
Description:Microsoft SysInternals是美国微软（Microsoft）公司的由Mark Russinovich于 1996 年创建，用于托管他的高级系统实用程序和技术信息。无论您是 IT 专业人员还是开发人员，您都会发现 Sysinternals 实用程序可以帮助您管理、排除故障和诊断您的 Windows 系统和应用程序。 Microsoft SysInternals存在安全漏洞。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。

Readme

# CVE-2023-29343

This is PoC for arbitrary file write bug in Sysmon version 14.14

![poc](https://github.com/Wh04m1001/CVE-2023-29343/assets/44291883/7793d64b-0382-4e3c-9f20-7adf19cafc9e)




After last patch Sysmon would check if Archive directory exists and if it exists it would check if archive directory is owned by NT AUTHORITY\SYSTEM and access is only granted to NT AUTHORITY\SYSTEM. 
If both conditions are true then Sysmon will write/delete files in that directory.

As its not possible to change ownership of file/directories as a low privilege user I had to find directory that is owned by SYSTEM but gives low privilege user (or any group low privilege user is a member of) full access or at least WRITE_DAC|DELETE|FILE_WRITE_ATTRIBUTES.

I could not find such directory on default installation but was able to create one by abusing Windows service tracing and RasMan service.

This PoC will only work on Sysmon version 14.14 and windows clients before April patch due to changes introduced with patch for CVE-2023-28222 which killed trick i used to create directory that is owned by SYSTEM and grant full access to low privilege user. PoC can be modified to work on clients after April patch if you can abuse other windows services to create directory (or find directories created by third party app's :) )
# References

https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/ (@itm4n)

File Snapshot


 [4.0K]  /data/pocs/82861b0c97e01d831432b0c3737abb5e88542950
├── [1.4K]  README.md
└── [4.0K]  SysmonEoP
    ├── [3.7K]  def.h
    ├── [ 91K]  dll.dll
    ├── [ 19K]  main.cpp
    ├── [745K]  resource.aps
    ├── [ 469]  resource.h
    ├── [1.5K]  resource.rc
    ├── [ 14K]  sysmon_c.c
    ├── [1.4K]  SysmonEOP.log
    ├── [1.4K]  SysmonEOP.sln
    ├── [7.4K]  SysmonEOP.vcxproj
    ├── [1.5K]  SysmonEOP.vcxproj.filters
    ├── [ 168]  SysmonEOP.vcxproj.user
    ├── [1.7K]  sysmon_h.h
    ├── [ 187]  sysmon.idl
    └── [ 14K]  sysmon_s.c

1 directory, 16 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!