This PoC shows a technique that can be used to weaponize privileged file write vulnerabilities on Windows. It provides an alternative to the DiagHub DLL loading "exploit" found by James Forshaw (a.k.a. @tiraniddo), which was fixed by Microsoft starting from build version 1903.
Starting from Windows 10, Microsoft introduced the Update Session Orchestrator
service. As a regular user, you can interact with this service using COM, and start an "update scan" (i.e. check whether updates are available) or start the download of pending updates for example. There is even an undocumented built-in tool called usoclient.exe
, which serves that purpose.
From an attacker's standpoint, this service is interesting because it runs as NT AUTHORITY\System
and it tries to load a non-existent DLL (windowscoredeviceinfo.dll
) whenever an Update Session is created.
This means that, if we found a privileged file write vulnerability in Windows or in some third-party software, we could copy our own version of windowscoredeviceinfo.dll
into C:\Windows\Sytem32\
and then have it loaded by the USO service to get arbitrary code execution as NT AUTHORITY\System
.
For more information:
Part 1 - https://itm4n.github.io/usodllloader-part1/
Part 2 - https://itm4n.github.io/usodllloader-part2/
This solution is composed of two projects: WindowsCoreDeviceInfo and UsoDllLoader.
-
WindowsCoreDeviceInfo provides a PoC DLL that will start a bind shell on port 1337 (localhost only), whenever the
QueryDeviceInformation()
function is called. That's the name of the function used by the USO workers. -
UsoDllLoader, is a stripped-down version of
usoclient.exe
. It can be run as a regular user to interact with the USO service and have it loadwindowscoredeviceinfo.dll
. Then, it will try to connect to the bind shell.
The solution is already preconfigured so compiling should be easy.
-
Select
Release
config andx64
architecure. -
Build solution.
-
Output files:
- The DLL:
.\x64\Release\WindowsCoreDeviceInfo.dll
- The loader:
.\x64\Release\UsoDllLoader.exe
- The DLL:
For testing purposes, you can:
- As an administrator, copy
WindowsCoreDeviceInfo.dll
toC:\Windows\System32\
. - Use the loader as a regular user.
- Hopefully enjoy a shell as
NT AUTHORITY\System
.
This method might not work in the following situations:
- One or several updates are waiting to be installed.
- Updates are being installed.
However, the Windows Update GUI ("Settings > Update & Security > Windows Update") seems to behave differently. Indeed, in this case, the DLL loading succeeds every time so, with some more work, I'm sure this technique can be improved.