TrueCrypt 7.1a / 7.2 DLL Hijacking

`Hi @ll,  
  
the executable installers "TrueCrypt Setup 7.1a.exe" and  
TrueCrypt-7.2.exe load and execute USP10.dll, RichEd20.dll,  
NTMarta.dll and SRClient.dll from their "application directory".  
  
For software downloaded with a web browser the application  
directory is typically the user's "Downloads" directory: see  
<https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html>,  
<http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html>  
and <http://seclists.org/fulldisclosure/2012/Aug/134> for "prior art"  
about this well-known and well-documented vulnerability.  
  
  
If an attacker places the above named DLLs in the users "Downloads"  
directory (for example per drive-by download or social engineering)  
this vulnerability becomes a remote code execution.  
  
Due to the application manifest embedded in the executables which  
specifies "requireAdministrator" the executable installers are run  
with administrative privileges ("protected" administrators are  
prompted for consent, unprivileged standard users are prompted for  
an administrator password); execution of the DLLs therefore results  
in an escalation of privilege!  
  
  
Proof of concept/demonstration:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
(verified on Windows XP, Windows Vista, Windows 7, Windows Server  
2008 [R2]; should work on newer versions too)  
  
1. visit <http://home.arcor.de/skanthak/sentinel.html>, download  
<http://home.arcor.de/skanthak/download/SENTINEL.DLL> and store  
it as USP10.dll in your "Downloads" directory, then copy it as  
NTMarta.dll, RichEd20.dll and SRClient.dll;  
  
2. download TrueCrypt-7.2.exe and "TrueCrypt Setup 7.1a.exe" and  
store them in your "Downloads" directory;  
  
3. run TrueCrypt-7.2.exe and "TrueCrypt Setup 7.1a.exe" from your  
"Downloads" directory;  
  
4. notice the message boxes displayed from the DLLs placed in step 1.  
  
PWNED!  
  
  
5. on Windows XP copy the downloaded USP10.dll as SetupAPI.dll (or  
create an empty file SetupAPI.dll), then rerun TrueCrypt*.exe  
from your "Downloads" directory.  
  
DOSSED!  
  
  
The denial of service from step 5. can easily be turned into an  
arbitrary code execution with elevation of privilege too: add the  
exports SetupDiOpenClassRegKey, SetupInstallFromInfSectionA,  
SetupOpenInfFileA and SetupCloseInfFile to the SetupAPI.dll copied  
to the "Downloads" directory.  
  
  
For this well-known (trivial, easy to avoid, easy to detect and  
easy to fix) beginner's error see  
<https://capec.mitre.org/data/definitions/471.html>,  
<https://technet.microsoft.com/en-us/library/2269637.aspx>,  
<https://msdn.microsoft.com/en-us/library/ff919712.aspx> and  
<https://msdn.microsoft.com/en-us/library/ms682586.aspx> plus  
<http://blogs.technet.com/b/srd/archive/2014/05/13/load-library-safely.aspx>  
  
  
See <http://seclists.org/fulldisclosure/2015/Nov/101>,  
<http://seclists.org/fulldisclosure/2015/Dec/86> and  
<http://seclists.org/fulldisclosure/2015/Dec/121> plus  
<http://home.arcor.de/skanthak/sentinel.html> and the still unfinished  
<http://home.arcor.de/skanthak/!execute.html> for more details and why  
executable installers (and self-extractors too) are bad and should be  
dumped.  
  
  
stay tuned  
Stefan Kanthak  
  
  
PS: I really LOVE (security) software with such trivial beginner's  
errors. It's a tell-tale sign to stay away from this crapware!  
  
  
Timeline:  
~~~~~~~~~  
  
2015-12-23 report sent to vendor  
  
NO ANSWER, not even an acknowledgement of receipt  
  
2016-01-01 reports resent to vendor  
  
NO ANSWER, not even an acknowledgement of receipt  
  
2016-01-08 report published  
`