Battle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically

## Overview

In this talk, Wenxu Wu from Tencent Security Xuanwu Lab presents research focused on discovering Windows logical privilege escalation vulnerabilities, specifically file privilege escalation bugs. Logical flaws occur when a restricted user interacts with a privileged system service via mechanisms like ALPC (Advanced Local Procedure Call) or COM, prompting the service to perform sensitive file operations (such as granting access, altering ownership, or creating/deleting/writing files) under a `SYSTEM` token. Traditional fuzzers target memory corruption rather than logical design issues, while manual reverse engineering of hundreds of ALPC interfaces and thousands of functions is resource-intensive. Wu introduces an automated approach using UI interactions and filesystem link manipulation to discover these flaws without relying on extensive manual reverse engineering.

---

## Historical Case Studies and Core Vulnerability Patterns

Wu examines historical vulnerabilities and common developer mistakes regarding token impersonation and file handling:

- **Task Scheduler DACL Modification**: A vulnerability reported in the Task Scheduler service allowed a restricted user to gain full control of arbitrary files. The service accepted an SDDL string parameter, canonicalized the path, converted the SDDL into a security descriptor, and reverted to a `SYSTEM` token before applying a new DACL via `AddRemovePrincipalAce`. Exploitation required creating a hard link to the target file and triggering the routine. - **Installer Service TOCTOU**: In the Windows Installer service, file-copying routines introduced a Time-of-Check to Time-of-Use (TOCTOU) race condition. The service temporarily impersonated the current user to verify read permissions, reverted to `SYSTEM`, and then copied the target file into a readable Windows Installer directory. Attackers could exploit this window using opportunistic locks (OpLocks via `DeviceIoControl`) to reliably win the race condition, or brute-force the timing window using `ReadDirectoryChangesW`. - **Assistant Service ALPC Metadata Read**: A semi-automated analysis of ALPC functions documented or gathered via spiders from MSDN revealed a vulnerability in the Assistant service. The service called `CreateFileW` under user impersonation to check read access, reverted to `SYSTEM`, and then read metadata from the file—repeating the improper impersonation pattern.

---

## The "Silver Bullet": Automated Discovery Framework via UI Interactions

Recognizing that manual reverse engineering of ALPC interfaces yields diminishing returns, Wu designed an automated testing framework based on triggering system operations via user interface interactions (such as opening Windows Store applications or interacting with system context menus):

1. **Triggering Execution**: The framework launches system applications and Windows Store applications from system and user directories, automating UI actions (e.g., button clicks). 2. **Monitoring Operations**: It hooks into or monitors system activity (using Process Monitor) to detect sensitive file actions, specifically `SetSecurity` calls that alter a target's DACL. 3. **Link Substitution**: The framework replaces target configuration and data paths with symbolic links (softlinks) or hard links pointing to restricted target files. 4. **Validation and Logging**: It evaluates whether the target file's DACL was modified under `SYSTEM` privileges, logging successful privilege escalations across multiple automated virtual machines.

---

## Vulnerabilities Discovered via the Framework

Using this automated framework, Wu identified several previously unknown vulnerabilities:

- **AppX / FX Development Services**: Launching default Windows applications (such as Windows Camera or Xbox Live) touched application settings files under the user's directory. By deleting the settings file and replacing it with a hard link pointing to a protected target file, launching the app triggered `SetSecurity` through internal object interfaces, granting the user full control over the target file. - **Standard Collector Service**: Triggered via menu button clicks, this service created a file and subsequently set a DACL on a file sharing the same base name without an extension. The service operated directly under `SYSTEM` privileges without impersonating the caller, exposing a race condition exploitable via hard links. - **Windows Defender Service**: When an unprivileged user initiates a scan on files across the system (including files in other user or system directories), Windows Defender invokes a system service to manage infected items. The service attempts to delete detected files via `SetFileDisposition`; if deletion fails, it applies a DACL to restrict access. By creating a text file detected as malicious and substituting it with a softlink before deletion occurred, the service altered the DACL on the link's target, borrowing `SYSTEM` privileges to modify permissions on arbitrary files.