Here I’m exploiting the arbitrary write vulnerability (CVE-2018-15732) by overwriting the _SEP_TOKEN_PRIVILEGES structure to obtain the SeCreateTokenPrivilege privilege. Then it\u2019s just a matter of calling the ZwCreateToken API to create a new privileged token. The excellent paper “Abusing Token Privileges For LPE<\/a>” and source code provided needed assistance in exploiting using this privilege.<\/p>\n The “what” dword value starts with 1 and increments each time our ioctl is called so a number of writes needed to be done in order to obtain a useful privilege.\u00a0Normal privileges would look like this<\/p>\n After a few writes the SeCreateTokenPrivilege privilege has been obtained. This is one of the privileges received most of the time.<\/p>\n For Windows 7 I’ve spawned a shell by switching to session 0 by calling WinStationSwitchToServicesSession(). The Windows Service “Interactive Services Detection” (UI0Detect) is set to manual and not started to begin with but starts when WinStationSwitchToServicesSession() is called. The first instance a prompt will be given to switch sessions, thereafter will switch automatically as the service is already started.<\/p>\n In Windows 10 (1803) the “Interactive Services Detection” service has been removed and doing a quick test on 1703 I realized the service can’t be started anyway so on Windows 10 I’m just adding the current user to the local administrators group.<\/p>\n The CreateProcessAsUser API doesn\u2019t always behave as expected as occasionally returns 1314 error which means “A required privilege is not held by the client”. Running the exploit a few times and it ends up working so not sure exactly what is really happening here. Trying to run the exploit in another user accounts shell i.e. not logging in with the account doesn\u2019t seem to work at all and always returns 1314 error so bear that in mind.<\/p>\n UPDATE: I just figured out the reason behind the 1314 error, since the CreateProcessAsUser API is still being called by our current process token so after the arbitrary writes sometimes the “SeAssignPrimaryTokenPrivilege” privilege is also obtained along with the “SeCreateTokenPrivilege” allowing the exploit to work. So even when our elevated token is successfully created we’ll need an added privilege “SeAssignPrimaryTokenPrivilege” for the CreateProcessAsUser API to succeed.<\/p>\n The current vulnerable version of STOPzilla AntiMalware is 6.5.2.59 of which the driver version szkg64.sys is 3.0.23.0. The exploit can be downloaded from here [zip<\/a>] and here is the direct link to the package on the StopZilla site if you wish to play with the exploit [msi<\/a>]<\/p>\n![](\"\/images\/80002063.png\")
<\/p>\nkd> dt nt!_SEP_TOKEN_PRIVILEGES fffff8a002f11060+40\r\n+0x000 Present : 0x6`02880000\r\n+0x008 Enabled : 0x800000\r\n+0x010 EnabledByDefault : 0x800000\r\n\r\nkd> !token fffff8a002f11060\r\n.\r\n.\r\n19 0x000000013 SeShutdownPrivilege Attributes - \r\n23 0x000000017 SeChangeNotifyPrivilege Attributes - Enabled Default \r\n25 0x000000019 SeUndockPrivilege Attributes - \r\n33 0x000000021 SeIncreaseWorkingSetPrivilege Attributes - \r\n34 0x000000022 SeTimeZonePrivilege Attributes - \r\n.\r\n.<\/pre>\n
kd> dt nt!_SEP_TOKEN_PRIVILEGES fffff8a002e61a90+40\r\n+0x000 Present : 0x6`00000015\r\n+0x008 Enabled : 0x16\r\n+0x010 EnabledByDefault : 0x800000\r\n\r\nkd> !token fffff8a002e61a90\r\n.\r\n.\r\n00 0x000000000 Unknown Privilege Attributes - \r\n02 0x000000002 SeCreateTokenPrivilege Attributes - Enabled \r\n04 0x000000004 SeLockMemoryPrivilege Attributes - Enabled \r\n33 0x000000021 SeIncreaseWorkingSetPrivilege Attributes - \r\n34 0x000000022 SeTimeZonePrivilege Attributes - \r\n.\r\n.<\/pre>\n
![](\"\/images\/cve-2018-15732_shell-w7.png\")
<\/p>\n![](\"\/images\/cve-2018-15732_inter-w7.png\")
<\/p>\n![](\"\/images\/cve-2018-15732-w10.png\")
<\/p>\n