Executive summary

• Akamai researcher Ben Barnea found an important vulnerability in the Windows Server service that was assigned CVE-2022-30216 and a base score of 8.8. [出自:jiwo.org]

• The vulnerability takes advantage of an off-by-one error in a security callback procedure that the Server service implements.

• We confirmed that the vulnerability exists in unpatched Windows 11 and Windows Server 2022 machines.

• When combined with a New Technology LAN Manager (NTLM) relay attack on the Active Directory Certificate Services (AD CS), the vulnerability gives an attacker with domain credentials the ability to run code remotely on the domain controller.

• We also believe that an attacker might be able to use this technique to modify a server’s certificate mapping and therefore perform server spoofing.

• The vulnerability was responsibly disclosed to Microsoft and addressed in July’s Patch Tuesday.

• We provide a proof of concept of the vulnerability in our Github repository.

Introduction

During the recent months, our team has conducted thorough research of Microsoft’s remote procedure calls (MS-RPC). Put simply, an RPC is used for efficient interprocess communications. It relies on a standard client-server model, and is one of the most widely used protocols in Windows today.

One of the more interesting aspects we have identified in the MS-RPC design is the security callback, which functions to restrict access to RPC servers, essentially providing security from unwanted, often remote, users. Many RPC servers implement a security callback, each server with its own logic and considerations.

Windows services make extensive use of RPC to make their functionality available for clients. This led us to investigate different services and the underlying logic of their security callback implementations. In one such service — the Server service — we were able to find a security flaw that could allow attackers to perform server spoofing or trigger authentication coercion on the victim.

In this blog, we will outline the aspects of RPC we have been researching that collectively contribute to this newfound bug: what the bug is, how it can be used, and how to mitigate it. 

What is Windows Server service?

The Server service (also called LanmanServer) is a Windows service that is responsible for the management of SMB shares. Shares are resources — files, printers, and directory trees — that are made accessible over the network by a Common Internet File System server. Essentially, network shares allow users to utilize other devices on the network to perform various daily tasks.

The Server service allows a remote machine to create, configure, query, and delete shares through RPC over a named pipe (\\pipe\srvsvc). For the remainder of this post, we will refer to the service as srvsvc.

A vulnerability in srvsvc is impactful because the service provides core functionality and therefore runs by default on every Windows machine.

SMB over QUIC

From Windows 10 20H2 onwards, Microsoft introduced a new feature — SMB over QUIC. The feature allows access to SMB shares through QUIC, a new transport-layer network protocol. QUIC’s purpose is to provide a more reliable and secure connection while also overcoming common internet problems, such as latency and packet loss.

In a QUIC network interaction, as an additional security measure, the client verifies the identity of the server by checking the certificate provided by the server. With the addition of SMB over QUIC, the Server service became responsible for managing those certificates. 

The vulnerability we found lies in this functionality. To understand it, we first need to explore one of the ways RPC servers perform access control.

Security callbacks

Many Windows services, srvsvc among them, implement an RPC server to allow for interprocess communication and to provide access to their functionality to different clients. RPC in Windows utilizes various security mechanisms; we will focus on one called security callback.

A security callback’s goal is to restrict access to an RPC interface. The callback is implemented by the RPC server developer, and it allows each developer to apply their own logic to allow access to specific users or prevent access to specific functions. In RPC, functions exposed by the server are represented using opnums (operation numbers), which we will see shortly in srvsvc’s security callback.