9 ms·

7-Zip up to 21.07 on Windows allows privilege escalation and command execution

227 points by jedisct1 5y ago

jmartinpetersen 5y ago
You need to drag the malicious .7z-file onto the 7Zip Help window. I don't know who is at fault, but that's a pretty weird intrusion vector.
- capableweb 5y ago
  A vector is a vector :) Imagine someone with just user privilege to a machine needing admin access to install more pervasive RAT, this gives them a way.
- toxicFork 5y ago
  Check out this cool Easter egg!
- m00dy 5y ago
  indeed, but still a 0day :) edit: I personally think the author did a great job finding & publishing it.
  - MrStonedOne 5y ago
    >edit: I personally think the author did a great job finding & publishing it. Not really. They seem to be implying they got to running a command as SYSTEM from 7-zip, but, like, don't specify things like what security context 7-zip started as, or how a program running as non-admin got to a system security context, or like, how that's 7zip's fault and not the fault of the OS. This is all very confusing. Even if all they did was took that screen shot from process explorer and expanded it to include the user column, it would be like 99% more clear what the fuck is going on.
  - rasz 5y ago
    >vulnerability was caused by hh.exe, but they were told that if there was a command injection from hh.exe, a child process should be created under hh.exe, so especially the heap-overflow side of this vulnerability will not be shared with the community. "Due to community security, it will not be published until the update is passed. Maybe it will never be published :)" would hardly call this publishing
- qwertyforce 5y ago
  1. Send broken archive to victim 2. "You have to update 7zip to open this archive, you don't need to open any executables, just drag 7zipv0.99.7z to help window" 3. ???? 4. Profit
teddyh 5y ago
Only on Windows, apparently.
- chasil 5y ago
  The 7-zip package in most Linux/BSD/POSIX distro repositories is still at 16.02 and I will be surprised if it changes. It wasn't even modified after the AES implementation was found to be somewhat lacking. https://sourceforge.net/p/sevenzip/bugs/2176/ https://sourceforge.net/p/sevenzip/bugs/2176/ https://piunikaweb.com/2019/02/01/insecure-aes-crypto-implementation-in-7zip-found-by-user/ https://piunikaweb.com/2019/02/01/insecure-aes-crypto-implem...
throwthere 5y ago
Quirky “0day.” Really makes you appreciate fuzzers.
willis936 5y ago
Why were the devs not responsibly informed?
- DaiPlusPlus 5y ago
  The repo doesn't contain any exploit code nor further technical details of the vuln, so I guess this is only semi-irresponsible-disclosure?
- bradleyjkemp 5y ago
  I think this is "zero day" in the sense of no patch is available, not in the sense of skipping responsible disclosure. This has a CVE number allocated (CVE-2022-29072) and the README mentions 7-zip disputing that this is their problem (rather, some underlying Windows component).
- encryptluks2 5y ago
  Imagine someone you think is homeless comes up to you and says, hey you left your child on top of your car. You say, thanks but did you fill out form K7804 to inform me responsibly about the issue. They say, form K7804? But your child, and that sounds like a lot of work to help you.. will you pay me to waste my time to help you? You say, no guarantees that I'll pay you but if you don't inform me responsibly, I'll tell everyone you are the bad person here.
  - willis936 5y ago
    What are you talking about? Analogies are weak point makers even when they're accurate, but what you're describing as entirely unrelated to what happened. This is Microsoft's bug that affects many programs. Was Microsoft informed before this exploit was made public? What does it buy anyone to throw this out in the public first? There is no indication that the exploit finder was hunting a bounty or denied a bounty. Afaict you fabricated a controversial story in your head then tried to explain it to everyone else.
  - jccalhoun 5y ago
    I think a better comparison would be: Someone has left a child on a car roof. Someone else sees it and instead of telling the person, posts about it online.
fuckcensorship 5y ago
This reminds me slightly of the recent Razer 0day [1] when plugging in a mouse. [1]: https://www.bleepingcomputer.com/news/security/razer-bug-lets-you-become-a-windows-10-admin-by-plugging-in-a-mouse/ https://www.bleepingcomputer.com/news/security/razer-bug-let...
divingdragon 5y ago
It seems that 7-zip opens the .chm help file using the HtmlHelp [1] WinAPI call. This API call does not even seem to run `hh.exe`. How does this privilege escalation actually work? [1]: https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/...
bramblerose 5y ago
Very confusingly written document, but from what I gather there are two vulnerabilities that are problematic for different reasons. 1) a command execution vulnerability in 7z. This is problematic because a downloaded 7z file could compromise your machine; 2) a privilege escalation vulnerability in the MS help viewer. This is problematic because it could allow an unprivileged user to gain admin rights. Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me. However the post presents them as one single vulnerability?
- smileybarry 5y ago
  > Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me. I don't get it either. From poking around in Process Explorer the help viewer window isn't its own process, it's still part of "7zFM.exe" which is running at medium integrity (not admin). Don't know where the high integrity context is coming from. I wonder if it's silent elevation, in which case just putting UAC on "always ask" is good enough (and what I do anyway).
  - divingdragon 5y ago
    The PoC video showed that the current user isn't in the "Administrator" group (though there is another user "zeroday" in there), which makes it look like not a simple UAC bypass. Or perhaps I misunderstood something.
  - Someone 5y ago
    Google tells me the help viewer uses IE7 with ActiveX to display help pages (https://www.comparitech.com/blog/information-security/malicious-chm-files/ https://www.comparitech.com/blog/information-security/malici...) Given that, I think this is better removed from any system. If you have to access .chm files, I would first try other tools for displaying html help (https://blog.kowalczyk.info/articles/chm-reader-viewer-for-windows.html https://blog.kowalczyk.info/articles/chm-reader-viewer-for-w... has a list)
    - badsectoracula 5y ago
MrStonedOne 5y ago
bee_rider 5y ago
I don't understand security stuff really (the computer misbehaves frequently enough when I'm not trying to do evil things to it, why would I try to make it worse?) but this seems a little weird to me. Why does 7zip even have admin privileges to give away, in the first place? It seems to be based on some odd interaction with the help system but I can't really parse the description. The description of the bug seems a bit weird > At this stage, 7-zip stated that the vulnerability was caused by hh.exe, but they were told that if there was a command injection from hh.exe, a child process should be created under hh.exe, so especially the heap-overflow side of this vulnerability will not be shared with the community. I think this is a reference to a conversation with the people behind 7-zip (?). It seems like a weird mix of technical details and finger-pointing. > As it is known, Microsoft HELPER ie hh.exe file "html help. full name microsoft html help executable. Program that opens help files with the chm extension." has been defined as. Many operations such as XXE, Command Execution are performed through the hh.exe file. It is possible to see vulnerabilities such as XXE or command execution in every program that uses the hh.exe interface. This issue came to my mind after the discovery of the XXE vulnerability detected by WinRAR. (https://www.exploit-db.com/exploits/47526 https://www.exploit-db.com/exploits/47526) Although the developers of 7-zip say that Microsoft should fix the command execution authority obtained from hh.exe at this point, it has been observed that at the end of the day, thanks to the heap overflow in 7zFM.exe and the command execution feature in hh.exe, privilege elevation is provided in the administrator mode. Seems like a pretty solid argument from the 7zip folks, right? They can't really be blamed if the Windows help system has decided to give them root for some reason. And since 7zip is partially open source, any would-be hacker could just grab an old version of the code if they wanted to weaponize this, right? But maybe there's something I'm missing.
api 5y ago
Windows privilege escalation bugs are so unbelievably common. We just fixed one in our MSI installer, and when I went to search for the CVE there were like 10 recent ones from different things including various VPN clients and shell extension apps. The culprit is usually the insane Windows ACL permission system. Unix permissions look like "rwxr-xr-x" while a very simple example of a Windows permission is: D:(A;OICI;FA;;;SY)(A;OICI;FA;;;WD) Windows is a single user OS. If you are depending on its local user permission access control to be anything more than advisory you are going to have a bad time.
- pjmlp 5y ago
  Lets not pretend UNIX doesn't have enough of their own, specially with setuid exploits.
  - api 5y ago
    Windows beats Unix variants by at least 10:1 on local privilege escalation bugs.
    - staticassertion 5y ago
      Not sure about that, but... 1. If we're talking about desktops systems, privesc is trivial in either OS. In Linux you can do a million things to privesc, such as snooping passwords via X11, modifying the various user files like ~/.bashrc with aliases, etc. On Windows UAC isn't even intended to be a barrier. 2. If we're talking about servers, I'm not sure that Windows is 10:1 worse on privescs.
      - zaarn 5y ago
        I'd say the main intention of UAC is to make sudo but without obvious vulnerabilities. The UAC dialog is wired deep into the system and you can't fake it. It takes priority over any UI stuff and won't accept input from a program you didn't specifically authorize (which requires accepting a UAC prompt). On the flipside, all it takes to manipulate sudo on Unix systems is to write a TTY emulator that just middlewares between the user and sudo. Then just alias via bashrc or any number of other places that can prompt for a user password. There is not protection sudo can deploy against that. Polkit helps a bit but X11 isn't great at helping there either since other programs can just send keystrokes.
branon 5y ago
No patch yet, apparently. 7-zip.org is still service binaries for 21.07 as of this writing
- caycep 5y ago
  looking at the SourceForge forums, it looks like the 7zip author still doesn't know where the security breach is coming from, but the security researcher doesn't seem forthcoming in pointing it out to him...
_hudj 5y ago
Seems like a big with MS help viewer more than 7z
Pxtl 5y ago
This looks more like a bug in Windows help system than 7zip. At least it's easy to avoid, although dragging and dropping files in 7zip is an expected operation, I don't think people are opening their "help" often. I wonder how many programs have this bug? How many programs have Windows help and involve dragging and dropping files?
- Kwpolska 5y ago
  This involves dragging-and-dropping files onto the Help window, not 7-zip proper. This is something nobody ever does, so it’s a classic overblown “vulnerability”.
  - zhfliz 5y ago
    while it's certainly something that's unlikely to be exploited by a remote attacker, local privilege escalation is a real issue. details on the LPE are not yet released, it's only shown in the video. assuming the LPE is real and also caused by 7-zip, this is a critical issue for anyone that has unprivileged users use their systems where 7-zip is installed.
mc4ndr3 5y ago
peazip
- k8sToGo 5y ago
  Is it better?
octagons 5y ago
The vulnerability in hh.exe is already well known and documented by the LOLBAS project [0]. My team and I (Adversary Simulation at IBM X-Force Red) conduct stealth-oriented red team security assessments and we use vulnerabilities like this to do our jobs every day - just as any red team worth its salt would. Capabilities like this are built into all kinds of tools that are installed by default on Windows. They are often essential to obtaining code or command execution on hosts through social engineering or post-exploitation when moving laterally between hosts. This is just speculation, but the privesc vulnerability might be related to memory allocation in the DLL used to integrate with the system shell context menu - i.e. right clicking on a file. Just a guess based on the mention of a heap overflow. [0] https://lolbas-project.github.io/lolbas/Binaries/Hh/ https://lolbas-project.github.io/lolbas/Binaries/Hh/
- tyingq 5y ago
  I think it's also probably somewhat common for run of the mill employees to use privilege escalation exploits to get admin access to do regular tasks. At least it was common in places I've worked where your local PC was so locked down that you couldn't do your job, and the official process to work around that wasn't reasonable. Enough people doing that opens up other unintended holes.
  - vorticalbox 5y ago
    At work I've used dirty sock[0] to gain su on a development server. [0]https://github.com/ROIGap/dirty_sock https://github.com/ROIGap/dirty_sock
  - staticassertion 5y ago
    I'm pretty sure I've used this exact attack to escalate privs back when I was in high school, to work around the school's restrictions.
  - _ofdw 5y ago
    For me it was installing a local account with admin privileges via Kali Linux.
kasabali 5y ago
What does it have to with 7zip, again? If there is a privilege escalation vulnerability in Windows Help Viever then nobody can stop anyone from writing a payload that mimicks the heap overflowing code in 7zip. But of course that doesn't get you clicks so why not bait everyone by attaching name of a popular open source software to it. Torvalds was spot on about security researchers.
- seizethegdgap 5y ago
  What did he say about security researchers?
  - kasabali 5y ago
    He has commented about security researchers and industry on several times over the years, but to sum it up we can say he doesn't think of very highly of them :p
AniseAbyss 5y ago
taviso 5y ago
I spoke to the researcher on twitter, his claims don't make much sense. He sent me a file he said proved his claims, but it was just some naïve attempt at directory traversal that couldn't possibly work. When I told him that, he said "that file doesn't belong to me anyway" - then explained he was planning his wedding and was too busy to answer more questions. Logically, if there was a way to escalate privileges via 7-zip, then it could also be exploited with CreateRemoteThread() - why would a heap overflow be necessary? What change to 7-zip has he requested that would prevent that? Why the bizarre drag-and-dropping operation, why not just double click a HTA file? I suspect there is no heap overflow and no privilege escalation.
- kagancapar 5y ago
kagancapar 5y ago
- Compy386 5y ago
  When you say the dll is running in the admin context, do you mean 7zFM.exe is running as admin?
kagancapar 5y ago
- nickitolas 5y ago
  Türkçe bilmediğim için google translate kullandığım için beni bağışlayın. Öncelikle, edindiğiniz incelemelerden bazılarını açıklamaya çalışmak istiyorum: Anladığım kadarıyla, kötü aktörler, sosyal deneyler veya tam şarlatanlar bir kereden fazla kendilerini twitter gibi yerlerde yasal güvenlik araştırmacıları olarak kurmayı başardılar. daha sonra teknik olmayan kişiler veya bir şeyleri iki kez kontrol etmeyen kişiler tarafından büyütülen yalanlar. Bu nedenle, bazı yüksek profilli güvenlik araştırmacıları, asılsız iddialarda bulunan ve onlara karşı uyarıda bulunan kişilere karşı temkinlidir. Bunu yayınlamanın/paylaşmanın ne anlamı var diye sormak istiyorum, bilinen bir yama yoksa bakımcılar bunun gerçek bir sorun olduğunu düşünmüyorlar ve aslında hiçbir detay paylaşmayacaksınız. İkinci soru, eğer yama yapılırsa/ne zaman olursa veya bakımcılar yama yapmayı reddederse daha ayrıntılı bir açıklama veya bir PoC yayınlamayı planlıyor musunuz?
  - logical_person 5y ago
    Super problematic that the HN mod team removed these posts by the author. His replies to this thread can likely be used to help ascertain the legitimacy of his claims, despite any rule-breaking they contained - let it be visible to the public.

227 points by jedisct1 5y ago

You need to drag the malicious .7z-file onto the 7Zip Help window. I don't know who is at fault, but that's a pretty weird intrusion vector.

capableweb 5y ago
A vector is a vector :) Imagine someone with just user privilege to a machine needing admin access to install more pervasive RAT, this gives them a way.
toxicFork 5y ago
Check out this cool Easter egg!
m00dy 5y ago
indeed, but still a 0day :) edit: I personally think the author did a great job finding & publishing it.
- MrStonedOne 5y ago
  >edit: I personally think the author did a great job finding & publishing it. Not really. They seem to be implying they got to running a command as SYSTEM from 7-zip, but, like, don't specify things like what security context 7-zip started as, or how a program running as non-admin got to a system security context, or like, how that's 7zip's fault and not the fault of the OS. This is all very confusing. Even if all they did was took that screen shot from process explorer and expanded it to include the user column, it would be like 99% more clear what the fuck is going on.
- rasz 5y ago
  >vulnerability was caused by hh.exe, but they were told that if there was a command injection from hh.exe, a child process should be created under hh.exe, so especially the heap-overflow side of this vulnerability will not be shared with the community. "Due to community security, it will not be published until the update is passed. Maybe it will never be published :)" would hardly call this publishing
qwertyforce 5y ago
1. Send broken archive to victim 2. "You have to update 7zip to open this archive, you don't need to open any executables, just drag 7zipv0.99.7z to help window" 3. ???? 4. Profit

teddyh 5y ago

Only on Windows, apparently.

chasil 5y ago
The 7-zip package in most Linux/BSD/POSIX distro repositories is still at 16.02 and I will be surprised if it changes. It wasn't even modified after the AES implementation was found to be somewhat lacking. https://sourceforge.net/p/sevenzip/bugs/2176/ https://sourceforge.net/p/sevenzip/bugs/2176/ https://piunikaweb.com/2019/02/01/insecure-aes-crypto-implementation-in-7zip-found-by-user/ https://piunikaweb.com/2019/02/01/insecure-aes-crypto-implem...

throwthere 5y ago

Quirky “0day.” Really makes you appreciate fuzzers.

willis936 5y ago

Why were the devs not responsibly informed?

DaiPlusPlus 5y ago
The repo doesn't contain any exploit code nor further technical details of the vuln, so I guess this is only semi-irresponsible-disclosure?
bradleyjkemp 5y ago
I think this is "zero day" in the sense of no patch is available, not in the sense of skipping responsible disclosure. This has a CVE number allocated (CVE-2022-29072) and the README mentions 7-zip disputing that this is their problem (rather, some underlying Windows component).
encryptluks2 5y ago
Imagine someone you think is homeless comes up to you and says, hey you left your child on top of your car. You say, thanks but did you fill out form K7804 to inform me responsibly about the issue. They say, form K7804? But your child, and that sounds like a lot of work to help you.. will you pay me to waste my time to help you? You say, no guarantees that I'll pay you but if you don't inform me responsibly, I'll tell everyone you are the bad person here.
- willis936 5y ago
  What are you talking about? Analogies are weak point makers even when they're accurate, but what you're describing as entirely unrelated to what happened. This is Microsoft's bug that affects many programs. Was Microsoft informed before this exploit was made public? What does it buy anyone to throw this out in the public first? There is no indication that the exploit finder was hunting a bounty or denied a bounty. Afaict you fabricated a controversial story in your head then tried to explain it to everyone else.
- jccalhoun 5y ago
  I think a better comparison would be: Someone has left a child on a car roof. Someone else sees it and instead of telling the person, posts about it online.

fuckcensorship 5y ago

This reminds me slightly of the recent Razer 0day [1] when plugging in a mouse. [1]: https://www.bleepingcomputer.com/news/security/razer-bug-lets-you-become-a-windows-10-admin-by-plugging-in-a-mouse/ https://www.bleepingcomputer.com/news/security/razer-bug-let...

divingdragon 5y ago

It seems that 7-zip opens the .chm help file using the HtmlHelp [1] WinAPI call. This API call does not even seem to run `hh.exe`. How does this privilege escalation actually work? [1]: https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/...

bramblerose 5y ago

Very confusingly written document, but from what I gather there are two vulnerabilities that are problematic for different reasons. 1) a command execution vulnerability in 7z. This is problematic because a downloaded 7z file could compromise your machine; 2) a privilege escalation vulnerability in the MS help viewer. This is problematic because it could allow an unprivileged user to gain admin rights. Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me. However the post presents them as one single vulnerability?

smileybarry 5y ago
> Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me. I don't get it either. From poking around in Process Explorer the help viewer window isn't its own process, it's still part of "7zFM.exe" which is running at medium integrity (not admin). Don't know where the high integrity context is coming from. I wonder if it's silent elevation, in which case just putting UAC on "always ask" is good enough (and what I do anyway).
- divingdragon 5y ago
  The PoC video showed that the current user isn't in the "Administrator" group (though there is another user "zeroday" in there), which makes it look like not a simple UAC bypass. Or perhaps I misunderstood something.
- Someone 5y ago
  Google tells me the help viewer uses IE7 with ActiveX to display help pages (https://www.comparitech.com/blog/information-security/malicious-chm-files/ https://www.comparitech.com/blog/information-security/malici...) Given that, I think this is better removed from any system. If you have to access .chm files, I would first try other tools for displaying html help (https://blog.kowalczyk.info/articles/chm-reader-viewer-for-windows.html https://blog.kowalczyk.info/articles/chm-reader-viewer-for-w... has a list)
  - badsectoracula 5y ago

MrStonedOne 5y ago

bee_rider 5y ago

I don't understand security stuff really (the computer misbehaves frequently enough when I'm not trying to do evil things to it, why would I try to make it worse?) but this seems a little weird to me. Why does 7zip even have admin privileges to give away, in the first place? It seems to be based on some odd interaction with the help system but I can't really parse the description. The description of the bug seems a bit weird > At this stage, 7-zip stated that the vulnerability was caused by hh.exe, but they were told that if there was a command injection from hh.exe, a child process should be created under hh.exe, so especially the heap-overflow side of this vulnerability will not be shared with the community. I think this is a reference to a conversation with the people behind 7-zip (?). It seems like a weird mix of technical details and finger-pointing. > As it is known, Microsoft HELPER ie hh.exe file "html help. full name microsoft html help executable. Program that opens help files with the chm extension." has been defined as. Many operations such as XXE, Command Execution are performed through the hh.exe file. It is possible to see vulnerabilities such as XXE or command execution in every program that uses the hh.exe interface. This issue came to my mind after the discovery of the XXE vulnerability detected by WinRAR. (https://www.exploit-db.com/exploits/47526 https://www.exploit-db.com/exploits/47526) Although the developers of 7-zip say that Microsoft should fix the command execution authority obtained from hh.exe at this point, it has been observed that at the end of the day, thanks to the heap overflow in 7zFM.exe and the command execution feature in hh.exe, privilege elevation is provided in the administrator mode. Seems like a pretty solid argument from the 7zip folks, right? They can't really be blamed if the Windows help system has decided to give them root for some reason. And since 7zip is partially open source, any would-be hacker could just grab an old version of the code if they wanted to weaponize this, right? But maybe there's something I'm missing.

api 5y ago

Windows privilege escalation bugs are so unbelievably common. We just fixed one in our MSI installer, and when I went to search for the CVE there were like 10 recent ones from different things including various VPN clients and shell extension apps. The culprit is usually the insane Windows ACL permission system. Unix permissions look like "rwxr-xr-x" while a very simple example of a Windows permission is: D:(A;OICI;FA;;;SY)(A;OICI;FA;;;WD) Windows is a single user OS. If you are depending on its local user permission access control to be anything more than advisory you are going to have a bad time.

pjmlp 5y ago
Lets not pretend UNIX doesn't have enough of their own, specially with setuid exploits.
- api 5y ago
  Windows beats Unix variants by at least 10:1 on local privilege escalation bugs.
  - staticassertion 5y ago
    Not sure about that, but... 1. If we're talking about desktops systems, privesc is trivial in either OS. In Linux you can do a million things to privesc, such as snooping passwords via X11, modifying the various user files like ~/.bashrc with aliases, etc. On Windows UAC isn't even intended to be a barrier. 2. If we're talking about servers, I'm not sure that Windows is 10:1 worse on privescs.
    - zaarn 5y ago
      I'd say the main intention of UAC is to make sudo but without obvious vulnerabilities. The UAC dialog is wired deep into the system and you can't fake it. It takes priority over any UI stuff and won't accept input from a program you didn't specifically authorize (which requires accepting a UAC prompt). On the flipside, all it takes to manipulate sudo on Unix systems is to write a TTY emulator that just middlewares between the user and sudo. Then just alias via bashrc or any number of other places that can prompt for a user password. There is not protection sudo can deploy against that. Polkit helps a bit but X11 isn't great at helping there either since other programs can just send keystrokes.

branon 5y ago

No patch yet, apparently. 7-zip.org is still service binaries for 21.07 as of this writing

caycep 5y ago
looking at the SourceForge forums, it looks like the 7zip author still doesn't know where the security breach is coming from, but the security researcher doesn't seem forthcoming in pointing it out to him...

_hudj 5y ago

Seems like a big with MS help viewer more than 7z

Pxtl 5y ago

This looks more like a bug in Windows help system than 7zip. At least it's easy to avoid, although dragging and dropping files in 7zip is an expected operation, I don't think people are opening their "help" often. I wonder how many programs have this bug? How many programs have Windows help and involve dragging and dropping files?

Kwpolska 5y ago
This involves dragging-and-dropping files onto the Help window, not 7-zip proper. This is something nobody ever does, so it’s a classic overblown “vulnerability”.
- zhfliz 5y ago
  while it's certainly something that's unlikely to be exploited by a remote attacker, local privilege escalation is a real issue. details on the LPE are not yet released, it's only shown in the video. assuming the LPE is real and also caused by 7-zip, this is a critical issue for anyone that has unprivileged users use their systems where 7-zip is installed.

mc4ndr3 5y ago

peazip

k8sToGo 5y ago
Is it better?

octagons 5y ago

The vulnerability in hh.exe is already well known and documented by the LOLBAS project [0]. My team and I (Adversary Simulation at IBM X-Force Red) conduct stealth-oriented red team security assessments and we use vulnerabilities like this to do our jobs every day - just as any red team worth its salt would. Capabilities like this are built into all kinds of tools that are installed by default on Windows. They are often essential to obtaining code or command execution on hosts through social engineering or post-exploitation when moving laterally between hosts. This is just speculation, but the privesc vulnerability might be related to memory allocation in the DLL used to integrate with the system shell context menu - i.e. right clicking on a file. Just a guess based on the mention of a heap overflow. [0] https://lolbas-project.github.io/lolbas/Binaries/Hh/ https://lolbas-project.github.io/lolbas/Binaries/Hh/

tyingq 5y ago
I think it's also probably somewhat common for run of the mill employees to use privilege escalation exploits to get admin access to do regular tasks. At least it was common in places I've worked where your local PC was so locked down that you couldn't do your job, and the official process to work around that wasn't reasonable. Enough people doing that opens up other unintended holes.
- vorticalbox 5y ago
  At work I've used dirty sock[0] to gain su on a development server. [0]https://github.com/ROIGap/dirty_sock https://github.com/ROIGap/dirty_sock
- staticassertion 5y ago
  I'm pretty sure I've used this exact attack to escalate privs back when I was in high school, to work around the school's restrictions.
- _ofdw 5y ago
  For me it was installing a local account with admin privileges via Kali Linux.

kasabali 5y ago

What does it have to with 7zip, again? If there is a privilege escalation vulnerability in Windows Help Viever then nobody can stop anyone from writing a payload that mimicks the heap overflowing code in 7zip. But of course that doesn't get you clicks so why not bait everyone by attaching name of a popular open source software to it. Torvalds was spot on about security researchers.

seizethegdgap 5y ago
What did he say about security researchers?
- kasabali 5y ago
  He has commented about security researchers and industry on several times over the years, but to sum it up we can say he doesn't think of very highly of them :p

AniseAbyss 5y ago

taviso 5y ago

I spoke to the researcher on twitter, his claims don't make much sense. He sent me a file he said proved his claims, but it was just some naïve attempt at directory traversal that couldn't possibly work. When I told him that, he said "that file doesn't belong to me anyway" - then explained he was planning his wedding and was too busy to answer more questions. Logically, if there was a way to escalate privileges via 7-zip, then it could also be exploited with CreateRemoteThread() - why would a heap overflow be necessary? What change to 7-zip has he requested that would prevent that? Why the bizarre drag-and-dropping operation, why not just double click a HTA file? I suspect there is no heap overflow and no privilege escalation.

kagancapar 5y ago

kagancapar 5y ago

Compy386 5y ago
When you say the dll is running in the admin context, do you mean 7zFM.exe is running as admin?

kagancapar 5y ago

nickitolas 5y ago
Türkçe bilmediğim için google translate kullandığım için beni bağışlayın. Öncelikle, edindiğiniz incelemelerden bazılarını açıklamaya çalışmak istiyorum: Anladığım kadarıyla, kötü aktörler, sosyal deneyler veya tam şarlatanlar bir kereden fazla kendilerini twitter gibi yerlerde yasal güvenlik araştırmacıları olarak kurmayı başardılar. daha sonra teknik olmayan kişiler veya bir şeyleri iki kez kontrol etmeyen kişiler tarafından büyütülen yalanlar. Bu nedenle, bazı yüksek profilli güvenlik araştırmacıları, asılsız iddialarda bulunan ve onlara karşı uyarıda bulunan kişilere karşı temkinlidir. Bunu yayınlamanın/paylaşmanın ne anlamı var diye sormak istiyorum, bilinen bir yama yoksa bakımcılar bunun gerçek bir sorun olduğunu düşünmüyorlar ve aslında hiçbir detay paylaşmayacaksınız. İkinci soru, eğer yama yapılırsa/ne zaman olursa veya bakımcılar yama yapmayı reddederse daha ayrıntılı bir açıklama veya bir PoC yayınlamayı planlıyor musunuz?
- logical_person 5y ago
  Super problematic that the HN mod team removed these posts by the author. His replies to this thread can likely be used to help ascertain the legitimacy of his claims, despite any rule-breaking they contained - let it be visible to the public.