by Mitja Kolsek, the 0patch Team
Wow, we're busy these days. Just yesterday we issued micropatches for the "Malicious Printer Driver" 0day, and today we're fixing a critical remote code execution issue that allows an anonymous attacker to take over a Windows Domain Controller: the infamous "PetitPotam" bug.
PetitPotam was discovered by security researcher topotam, who published their proof-of-concept on Github on July 20, 2021. There is no official vendor patch for it at the time of this writing; in fact, Microsoft's support article implies they do not consider this a vulnerability but rather a mis-configuration, and provides some generic mitigations that do not address the root issue.
Again, CERT/CC vulnerability note by Will Dormann nicely explains the vulnerability and an exploit chain leading to an complete domain takeover. The main problem is that a non-admin - even anonymous - user can force a domain controller to send NTLM credentials of its computer account to attacker's server, where these can be received and then relayed to another service in the domain to make a malicious privileged request.
Analysis
(TBD - please visit within a few hours for updated content)
Micropatch
Our micropatch extends the impersonation block such that it now encloses the previously un-impersonated call to EfsGetLocalFileName, resulting in the SMB request which this function triggers containing attacker's NTLM credentials instead of computer account's. Therefore, in case of an anonymous request the attacker gets credentials of the ANONYMOUS LOGON user (which are of no use), and if they use credentials of a Windows domain user, the acquired NTLM credentials will be of that same user (which they already have).
The patch contains two patchlets, one starting impersonation by calling RpcImpersonateClient, and another stopping impersonation by calling RpcRevertToSelf.
MODULE_PATH "..\Affected_Modules\efslsaext.dll_10.0.17763.1075_64bit_WinSrv2019-u202107\efslsaext.dll"
PATCH_ID 663
PATCH_FORMAT_VER 2
VULN_ID 7174
PLATFORM win64
patchlet_start
PATCHLET_ID 1
PATCHLET_TYPE 2
PATCHLET_OFFSET 0x280c
N_ORIGINALBYTES 5
JUMPOVERBYTES 0
PIT rpcrt4!0x53370,efslsaext!0x288c
;0x53370 -> RpcImpersonateClient
;0x288c -> Error block
code_start ;Injected at the top of the block containing
EfsRpcGetLocalFileName, in the EfsRpcOpenFileRaw_Downlevel
function
mov rcx, 0 ;Set rcx for RpcImpersonateClient to 0, so it
impersonates the current client
call PIT_0x53370 ;Call RpcImpersonateClient
mov rbx, rax ;Move the result to rbx, so it can be used for error
reporting in case of failure
cmp rax, 0 ;Check if impersonation failed
jne PIT_0x288c ;If failed, jump to error block
code_end
patchlet_end
patchlet_start
PATCHLET_ID 2
PATCHLET_TYPE 2
PATCHLET_OFFSET 0x288c
N_ORIGINALBYTES 5
JUMPOVERBYTES 0
PIT rpcrt4!0x563b0
;0x563b0 -> RpcReverToSelf
code_start ;Injected at the top of the block right after the
RpcRevertToSelf call, in the EfsRpcOpenFileRaw_Downlevel function
call PIT_0x563b0 ;Call RpcRevertToSelf to stop impersonating
code_end
patchlet_end
This micropatch was written for:
- Windows Server 2019 (updated with July 2021 Updates)
- Windows Server 2016 (updated with July 2021 Updates)
- Windows Server 2012 R2 (updated with July 2021 Updates)
-
Windows Server 2008 R2 (updated with January 2020 Updates, no Extended Security Updates)
As far as we could test, Windows Server 2012 (non R2), Windows Server 2008 (non R2) and Windows Server 2003 are not affected by this issue.
Micropatches for this vulnerability will be free until Microsoft has issued an official fix. If you want to use them, create a free account at 0patch Central, then install and register 0patch Agent from 0patch.com. Everything else will happen automatically. No computer reboots will be needed.
Compatibility note: Some Windows 10 and Server systems exhibit occasional timeouts in the Software Protection Platform Service (sppsvc.exe) on a system running 0patch Agent. This looks like a bug in Windows Code Integrity mitigation that prevents a 0patch component to be injected in the service (which is okay) but sometimes also does a lot of seemingly meaningless processing that causes process startup to time out. As a result, various licensing-related errors can occur. The issue, should it occur, can be resolved by excluding sppsvc.exe from 0patch injection as described in this article.
Credits
We'd like to thank topotam for sharing details about this vulnerability, and Will Dormann, Benjamin Delpy and Kevin Beaumont for sharing lots of useful insights and context that helped us understand this vulnerability and create this micropatch to protect 0patch users.
Please revisit this blog post for updates or follow 0patch on Twitter.
Article Link: 0patch Blog: Free Micropatches for "PetitPotam"