Falha no Steam deixa 72 milhões de utilizadores do Windows 10 em risco

The vulnerability itself is very simple. Steam installs “Steam Client Service” service for some internal purposes. Let’s check SDDL (https://habr.com/ru/company/pm/blog/442662/) of the service:

O:SYG:SYD:(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;RPWP;;;BU)

Most interesting part is (A;;RPWP;;;BU). It means that any user from the group “Users” is permitted to Start and Stop the service.

Now we examine the service's behavior at start. There is nearly nothing interesting in fact, but some registry operations look strange. Service enumerates subkeys of HKLM\Software\Wow6432Node\Valve\Steam\Apps and sets some security descriptions for each.

What is this security description about? I created test key HKLM\Software\Wow6432Node\Valve\Steam\Apps\test and restarted the service (Procmon’s log is above) and checked registry key permissions. Here I found that HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit “Full control” for “Users” group, and these permissions inherit for all subkeys and their subkeys. I assumed that RegSetKeySecurity sets same rights, and something interesting would happen if there were a symlink. I created a link from HKLM\SOFTWARE\Wow6432Node\Valve\Steam\Apps\test to HKLM\SOFTWARE\test2 and restarted the service.

Steam’s service sets security descriptor for our target-key. Review SDDL for the key (non-interesting data is omitted):

(A;ID;KA;;;BU)(A;OICIIOID;GA;;;BU)

In other words, it means full (read and write) access to the key for all users. This is the security descriptor the service has set to the key.

So, now we have a primitive to take control on almost every key in the registry, and it is easy to convert it into a complete EoP (Escalation of Privileges). I choose key HKLM\SYSTEM\ControlSet001\Services\msiserver that corresponds with the service “Windows Installer”, which can be started by any user, same as Steam’s service, but run program as NT AUTHORITY\SYSTEM. After taking control, it is only necessary to change ImagePath value of the HKLM\SYSTEM\ControlSet001\Services\msiserver key and start “Windows Installer” service. The program from ImagePath will be started as NT AUTHORITY\SYSTEM.

Put all things together and we get exploit that allows running any program with the highest possible rights on any Windows computer with Steam installed.