Windows Exploitation Tricks: Spoofing Named Pipe Client PID

https://googleprojectzero.blogspot.com/2019/09/windows-exploitation-tricks-spoofing.html

by weinzierl • 7 years ago

51 12 7 years ago

googleprojectzero.blogspot.com

mehrdadn• 7 years ago

Summary of the takeaway: the GetNamedPipeClientProcessId function returns the PID of the process that opened the pipe, not the one that is currently communicating. However, the client PID can sometimes be specified manually, and even when it can't, handle duplication followed by PID recycling can make this PID point to an arbitrary process (hence it should not be used for security checks).

tinus_hn• 7 years ago

So what is the use of this function?

londons_explore• 7 years ago

Perhaps just for putting an informative PID in log messages?

ammmir• 7 years ago

Wouldn't it be better to return a kind of ENOENT status if the process creating the pipe has disappeared (or its PID recycled)? Seems like a design flaw since PIDs have finite lifetimes and not communicating that through any API call return could pose a potentially serious security issue.

muststopmyths3• 7 years ago

It was clear that there must be some applications which use the client PID for the purposes of security enforcement. However I couldn’t find any first-party applications installed on Windows which used the PID for anything security related. Third-party applications are another matter and other researchers have found examples of using the PID to prevent untrusted callers from accessing privileged operations, a recent example was Check Point Anti-Virus. As relying on this PID is dangerous I decided I should highlight ways of spoofing the PID value so that developers can stop using it as an enforcement mechanism and demonstrate to researchers how to exploit such dangerous checks.

So, not a "Windows Exploitation Trick".

Even the so-called "example" with Checkpoint is nothing of that sort. They were using the PID to find the executable and verify that it was signed with their certificate. The actual exploit in the link to the Checkpoint vulnerability has to do with spoofing the cert, nothing to do with the PID.

The post is about a bullshit hypothetical "authentication" method that I have never seen anyone use in 25+ years of Windows programming.

Edit: clarify last sentence

I lost all respect for Project Zero this week.

izacus• 7 years ago

I lost all respect for Project Zero this week.

Aren't you being a bit... dramatic?

muststopmyths3• 7 years ago

I respect their technical expertise, of course. So, maybe all is an exaggeration :-)

rootw0rm• 7 years ago

long time Windows RCE guy here, i agree that this PID "issue" is nonsense. no serious person anywhere has ever secured something with just a PID. that's ridiculous.

cyphar• 7 years ago

It should be noted that on Linux, PIDs are used for authentication (see SCM_CREDENTIALS and basically all of polkit). This is why Linux has recently gained "pidfd" support to avoid exploitable PID reuse races.

0xfffff• 7 years ago

Yeah, recently Project 0 did a few odd things... first the dramatic iPhone stunt, then more of silence post about Android kernel 0 day still today actively used to exploit Pixel phones...

Now more Windows bashing - I know they try to be independent, but its become pretty obvious who pays the bills. Wish Chris Evans would have a say.

Windows Exploitation Tricks: Spoofing Named Pipe Client PID

Related Stories