win32k.sys<\/code> component. Once the exploit was discovered and analyzed, it was reported to the Microsoft Security Response Center, who promptly fixed the vulnerability and released a patch<\/a>.<\/p>\n\n\n\nThe vulnerability affects the following Windows versions:<\/p>\n\n\n\n
- Windows 7 for 32-bit Systems Service Pack 1<\/li>
- Windows 7 for x64-based Systems Service Pack 1<\/li>
- Windows Server 2008 for 32-bit Systems Service Pack 2<\/li>
- Windows Server 2008 for Itanium-Based Systems Service Pack 2<\/li>
- Windows Server 2008 for x64-based Systems Service Pack 2<\/li>
- Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1<\/li>
- Windows Server 2008 R2 for x64-based Systems Service Pack 1<\/li><\/ul>\n\n\n\n
This blog post focuses on the technical details of the vulnerability and its exploitation. Another post<\/a> delves into the malware sample and its broader implications.<\/p>\n\n\n\nExploitation<\/strong><\/p>\n\n\n\nAs with a number of other Microsoft Windows win32k.sys<\/code> vulnerabilities disclosed in recent years, this exploit uses popup menu objects. For example, the Sednit group\u2019s local privilege escalation exploit that we analyzed in 2017<\/a> used menu objects and techniques very similar to the current exploit.<\/p>\n\n\n\nThis exploit creates two windows; one for the first stage and another one for the second stage of the exploitation. For the first window, it creates popup menu objects and appends menu items using the CreatePopupMenu<\/code> and AppendMenu<\/code> functions. In addition, the exploit sets up WH_CALLWNDPROC<\/code> and EVENT_SYSTEM_MENUPOPUPSTART<\/code> hooks.<\/p>\n\n\n\nThen the exploit displays a menu using the TrackPopupMenu<\/code> function. At this point the code hooked to EVENT_SYSTEM_MENUPOPUPSTART<\/code> gets executed. This code attempts to open as the first available item in the menu, by sending a sequence of MN_SELECTITEM<\/code>, MN_SELECTFIRSTVALIDITEM<\/code> and MN_OPENHIERARCHY<\/code> messages to the menu.<\/p>\n\n\n\nThe next step is very important for triggering this vulnerability. The exploit must catch the moment in time when the initial menu is already created, but the sub-menu is only about to be created. For that, the exploit has code that handles the WM_NCCREATE<\/code> message in the WH_CALLWNDPROC<\/code> hook. When the exploit code detects the system is in this state, it sends MN_CANCELMENUS<\/code> (0x1E6) message to the first menu, which cancels that menu. However, its sub-menu is still about to be created.<\/p>\n\n\n\nNow if we check this sub-menu object in kernel mode, we would see that tagPOPUPMENU\u2011>ppopupmenuRootequals 0<\/code>. This state allows the attacker to use that element in this kernel structure as a NULL pointer dereference. The exploit allocates a new page at address 0x0 and this address will be treated as a tagPOPUPMENUobject<\/code> (see Figure 1) by the kernel.<\/p>\n\n\n\n![\"\"](\"https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2019\/07\/01_tagPOPUPMENU_NULL_red-1.png\")
<\/a><\/figure>\n\n\n\nFigure 1. The <\/em>tagPOPUPMENU<\/code> kernel structure<\/em><\/p>\n\n\n\nAt this point, the attackers use the second window. The main exploit goal is to flip the bServerSideWindowProc<\/code> bit in the tagWND<\/code> structure of the second window. This causes the execution of a WndProc<\/code> procedure in kernel mode.<\/p>\n\n\n\nTo perform that, the attackers leak the kernel memory address of the tagWND<\/code> structure of the second window by calling the non-exported HMValidateHandle<\/code> function in the user32.dll<\/code> library. Then the exploit crafts a fake tagPOPUPMENU<\/code> object at the NULL page and sends a MN_BUTTONDOWN<\/code> message to a sub-menu.<\/p>\n\n\n\nAfter that, the kernel will eventually execute the win32k!xxxMNOpenHierarchy<\/code> function.<\/p>\n\n\n\n![\"\"](\"https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2019\/07\/02_HMAssignmentLock-1.png\")
<\/a><\/figure>\n\n\n\nFigure 2. Disassembled code of the <\/em>win32k!xxxMNOpenHierarchy<\/code> function<\/p>\n\n\n\nThis function passes a crafted object at the NULL page to win32k!HMAssignmentLock<\/code>. The bServerSideWindowProc<\/code> bit is set inside the win32k!HMDestroyUnlockedObject<\/code> function, which is located a few calls deeper inside win32k!HMAssignmentLock<\/code>.<\/p>\n\n\n\n![\"\"](\"https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2019\/07\/03_HMDestroyUnlockedObject-1.png\")
<\/a><\/figure>\n\n\n\nFigure 3. Disassembled code of the <\/em>win32k!HMDestroyUnlockedObject<\/code> function<\/p>\n\n\n\nEverything is done! Now the exploit can send a specific message to the second window in order to execute WndProc<\/code> in kernel mode.<\/p>\n\n\n\nConclusion<\/strong><\/p>\n\n\n\nThe exploit only works against older versions of Windows, because since Windows 8 a user process is not allowed to map the NULL page. Microsoft back-ported this mitigation to Windows 7 for x64-based systems.<\/p>\n\n\n\n
People who still use Windows 7 for 32-bit systems Service Pack 1 should consider updating to newer operating systems, since extended support of Windows 7 Service Pack 1 ends on January 14th<\/sup>, 2020<\/a>. Which means that Windows 7 users won\u2019t receive critical security updates. Thus, vulnerabilities like this one will stay unpatched forever.<\/p>\n\n\n\nIndicators of Compromise (IoCs)<\/strong><\/p>\n\n\n\nSHA-1 hash<\/th> ESET detection name<\/th><\/tr><\/thead> CBC93A9DD769DEE98FFE1F43A4F5CADAF568E321
<\/td> Win32\/Exploit.CVE-2019-1132.A<\/td><\/tr><\/tbody><\/table>\n\n\n\n