From LNK to RCE: Finding bugs in Windows Shell Link Parser - Lays

# From LNK to RCE: Finding bugs in Windows Shell Link Parser - Lays {%hackmd @HITCON/r1z4zylVv %} > 從這開始 who am i - Lays senior researcher at TeamT5 focus on reverse engineering vulnerability research ... ## Angenda motivation Windows LNK file format fuzzing the parse case study reversing the undocumented logic case study .. ## motivation while studying for master's degreee i created a fuzzer for windows based on winafl + static binary instrumentation high performance ... finding fuzzing targets complex binary format which is win afl good at better to be remote triggerable lnk remote code execution vulnerability windows lnk file also known as shortcut windows shell link what you see is what you parsed and get you pwned removable drives remote share sounds cool lets fuzz this demo lnk dos windows lnk format lnk is really complicatd on linux macos its really hard remember the order but on windows its harder ... ## SHELL_LINK - windows shell link file format - header - header size - linkclsID - LinkFlags - attribuite - creationtime - accessTime - WriteTime - FileSize - ... - targetIDList(most complicated) - IDListSize - IDList:Volume+Directory+File(windows未公開的格式) - TerminalID - 有些欄位無法以path表示 - recycle bin -> ??? - control panel -> ??? - printers -> ??? - linkInfo - StringData - ExtraData - BlockSize - BlockSignature - Length - Version - MachineID - Droid - ... example : lnk to c:/test/a.txt shelllinkheader 4c000 0000 .... header size linkclsid linkflags file attributes create time access time ... linktargeridlist idlistsize 0xBD idlist[0] root folder idlist[1] volume idlist[2] directory idlist[3] file terminalid linkinfo linkinfosize linkinfoheadersize linkinfoflags ... stringdata hasrelativepath ... extradata blocksize blocksignature length version machineid droid droidbirth terminalblock ## Windows Link Format - MSDN - LECmd - liblik/libfwis lnk format resources msdn ms-shllink lecmd lnk explorer command line edition liblik libfwsi detailed lnk shell itm format ## fuzzing write the harnesss prepare corpus collect different lnk files create manually testcases from github old cve poc ... run the fuzzer check code coverage with drcov and light house + ida pro use interesting testcases as new seed reversing the target to help fuzzer ## fuzzing harness - reversing explorer - we known the lnk is handled by ishelllink in windows storage dill copy example code of ishelllink::load from msdn wrap with while loop also instructment windows.storage.dll lnk bugs in the past CVE-2017-8464(stuxnet3.0/CPL logic bug) actually a logical bug in CControlPanelFolder ... haslinktargetIDlist flag ... linktargetidlist contains 3 itemids contains a specialolerdatablock ... use it as corpus try to focused on linkflags ... found first crach afte only few hours found a heap overflow in cinternetfolder::parsedisplayname will be called try to convert our uri "A|" into item identifier list validate urI ... `_ensureiuri` will fail if uri is a file path we set ... if uri is not a file path allocate a buffer and validate it with `_validateurl` ... `_validateurl` will convert uri to qualified url with file uri scheme remember the small buffer heap overflow its actually and ancient bug at least exits since windows 2000 caller must provide a buffer larger than 2084 bytes we'll assume that if the second character is a: or | this is an url of ... spcialfolerdatablock back to our poc what is csidl constant special item id list system independent way to identify special folders. sysem foler may be ... `csidl_controls` -> ccontrolpanelfoler::parser... by assigning diff ... most of special folder are handled by cfsfoler::paer... as of windows vista csidl have been replaced by knownflolderid we found ... collect knownfolderid from knownfolder.h ... fuzzing result serveral dos bugs found in different interfaces not bad but useless where is an interface there is a way # windows search lnk secret in lnk file format when collecting coropus for fuzzing ... i found a special kind of lnk can be ... secret in lnk file format it contains some complex data blobs ... digging depper propvariant deserialization undocumented data format parsered by windows search and structuredqurey ... deserialize data from stram in to a propvariant structure we already have oproperty storage why reinventing the wheel let reverse propvariant can hold different types of data as an union char short lon float bool ... code ... `vt_decimal` is a special case decimal has the same size as propvariant structure msdn says .. the first member of the decimal structure is not used and is equal in size to the vt member of the propvariant structure to put the value ... readpropvanriant read decimal from file without resetting vt to vt_decimal which means we can control the type of ... obviously dont read document forge an istram object by overwriting vt to vt_streamed_object modify the serialized data in a search lnk readpropvariant does not support istram object desearialization but it still use propvariantclear to release the pro.... type confusion leads to arbitration free clsid and clipdata in propvar... reading data for vt_clsid with out allocating a buffer reading data for vt_ct with allocating a buffer provariant is initialized when readpropvariant called prop -> puuid are always null ... uninitialized memory in case vt_variant we can call readpropvariant again with uninitialized ... combine 2 bugs : uninitialized memory + invalid pointer dereference leads to ... no more bugs i have reversed every line of code and checked multple times ... readpropvairnat also supports vector desierialization if the type is vy_XXX | vt_vector then read it as a vector when a vt_bstr_blob vector deserialized ... no matte whether bt_vetor is set it is read ... but when it was about to be released ... it is still treat as a vector ... type confusion leads to arbitrary free bugs in a single function ... arbitrary call arbitrary write arbitrary tree result remote code execution ... 10+ will not fix ... more lnk bugs has been found !exploitable exploit is hard under windows aslr but not impossible third party shell extension without dynamicbase maybe possible to combine with windows search structuredquery demo conclusion I LOVE MICROSOFT windows is complicated lack of comprehensive testing some code may not even use ... thanks @_L4ys twitter ###### tags: `HITCON2020`,`HITCON`

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.