{"id":114,"date":"2020-04-27T09:54:38","date_gmt":"2020-04-27T09:54:38","guid":{"rendered":"http:\/\/labs.redyops.com\/?p=114"},"modified":"2020-06-24T07:41:22","modified_gmt":"2020-06-24T07:41:22","slug":"dos-via-arbitrary-folder-creation","status":"publish","type":"post","link":"https:\/\/labs.redyops.com\/index.php\/2020\/04\/27\/dos-via-arbitrary-folder-creation\/","title":{"rendered":"Windows Denial of Service Vulnerability (CVE-2020-1283)"},"content":{"rendered":"
<\/a><\/a><\/a><\/a><\/a><\/a><\/a><\/a><\/a><\/a><\/a><\/div><\/div>\n\n\n\n

Summary<\/strong><\/h1>\n\n\n\n

Assigned CVE<\/strong>: CVE-2020-1283 has been assigned and RedyOps Labs has been publicly acknowledged by the vendor.<\/p>\n\n\n\n

Known to Neurosoft\u2019s RedyOps Labs since<\/strong>: 11\/03\/2020<\/p>\n\n\n\n

Exploit<\/strong> Code<\/strong>: https:\/\/github.com\/RedyOpsResearchLabs\/CVE-2020-1283_Windows-Denial-of-Service-Vulnerability<\/a> <\/p>\n\n\n\n

Vendor\u2019s Advisory<\/strong>: https:\/\/portal.msrc.microsoft.com\/en-us\/security-guidance\/advisory\/CVE-2020-1283<\/a><\/p>\n\n\n\n

This issue has the following description on Microsoft’s advisory:<\/p>\n\n\n\n

” A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding.<\/p>

To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application or to convince a user to open a specific file on a network share. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to cause a target system to stop responding.<\/p>

The update addresses the vulnerability by correcting how Windows handles objects in memory.”<\/p><\/blockquote>\n\n\n\n

We will use a different description, based on the exploit we provided to Microsoft in order to abuse this vulnerability. Our description, may not be technically as accurate as Microsoft’s description, but our approach may allow someone out there to take this vulnerability beyond the DOS. <\/p>\n\n\n\n

An arbitrary folder creation exists on Windows 10 1909. This specific case allows a user with low privileges to create an empty folder, with any chosen name, anywhere in the system. The folders we create inherit their DACL and thus we couldn’t find a way to exploit the issue in order to perform an Escalation of Privilege. However, we are able to exploit any arbitrary file\/folder creation in order to cause a Blue Screen of Death (BSoD). The latest version we tested is windows 10 1909 (OS Build 18363.778) 64bit .<\/p>\n\n\n\n

Description<\/strong><\/h1>\n\n\n\n

A user with low privileges (the “attacker”), has full control over the folder c:\\Users\\attacker\\AppData\\Roaming\\Microsoft\\Windows . This, allows him to rename the folder to c:\\Users\\attacker\\AppData\\Roaming\\Microsoft\\Windows2 . <\/p>\n\n\n\n

If a user\/attacker performs the aforementioned rename action, there are specific circumstances and actions which can be followed in order to force the NT AUTHORITY\\SYSTEM to recreate the following folders:<\/p>\n\n\n\n