BITSInject

Windows BITS Service

Windows' Background Intelligent Transfer Service (BITS) acts as a middleman for download jobs. From the moment a job is created, BITS manages the download lifecycle and handles queue management.

Vulnerability Discovery

Researchers discovered how BITS maintains its job queue using a state file on disk. The binary structure of this state file can be modified by local administrators to control jobs using special modifications to the file.

Exploitation Technique

By comprehending the binary structure of the state file, attackers can change job properties such as RemoteURL and Destination Path at runtime. They can also inject custom jobs without using BITS' public interfaces.

Code Execution

Combined with BITS' notification feature, this technique allows running arbitrary programs as the LocalSystem account within session 0. The researchers provide a one-click Python tool that performs the attack, SimpleBITSServer, and struct definition files for parsing BITS state files.