0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Microsoft Windows Containers Privilege Escalation Vulnerability
Author
Risk
[
Security Risk High
]0day-ID
Category
Date add
CVE
Platform
Windows Containers: ContainerUser has Elevated Privileges Windows Containers: ContainerUser has Elevated Privileges Platform: Windows 10 20H2 (not tested other versions) Class: Elevation of Privilege Security Boundary: User Summary: The standard user ContainerUser in a Windows Container has elevated privileges and High integrity level which results in making it administrator equivalent even though it should be a restricted user. Description: Windows Containers setup two default user accounts, which are created by the CExecSvc service. The first user, ContainerAdministrator is a full administrator. The second user, ContainerUser you would assume is not supposed to be an administrator. However, both users are created as virtual service accounts, this results in ContainerUser being granted SeImpersonatePrivilege, SeCreateGlobalPrivilege and runs with a High integrity level. At a minimum having SeImpersonatePrivilege is considered administrator equivalent. You can use public exploits such as RogueWinRM (https://github.com/antonioCoco/RogueWinRM) to get SYSTEM from ContainerUser, but I'm sure there are other techniques to do the same thing. For example the following is the output from a ServerCore 20H2 image running in Hyper-V (but the container isolation doesn't seem to matter). C:\\> ver Microsoft Windows [Version 10.0.19042.685] C:\\> whoami /groups /priv GROUP INFORMATION ----------------- Group Name Type SID Attributes ==================================== ================ ============ ================================================== Mandatory Label\\High Mandatory Level Label S-1-16-12288 ... PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======== SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled The issue is as far as I understand it ContainerUser should not be administrator equivalent otherwise there seems little point to have two separate users. I'd recommend ensuring SeCreateGlobalPrivilege is also removed, while it's not as easy to exploit it could still provide a means of compromising the container. Also the CExecSvc looks to be code written and signed by Microsoft so I assume it's in scope as a Microsoft product. Proof of Concept: I just installed Docker Desktop on Windows 10 20H2. Then ran the command: C:\\> docker run --user=ContainerUser -it mcr.microsoft.com/windows/servercore:20H2 Then in the container I ran the following command to display the user's details. C:\\> whoami /groups /priv Expected Result: The ContainerUser does not have elevated privileges. Observed Result: The ContainerUser has SeImpersonatePrivilege. This bug is subject to a 90 day disclosure deadline. After 90 days elapse, the bug report will become visible to the public. The scheduled disclosure date is 2021-03-14. Disclosure at an earlier date is also possible if agreed upon by all parties. Related CVE Numbers: CVE-2021-26891. # 0day.today [2024-12-23] #