[EXPLOIT] [MICROSOFT] Élévation de privilèges via une vulnérabilité au sein de Windows (MS15-010)

La vulnérabilité en question, référencée CVE-2015-0003, affecte le système d’exploitation Microsoft Windows. L’exploitation de cette faille permet d’élever ses privilèges sur un système.

La preuve de concept se matérialise sous la forme d’un code en C++. Ce code permet d’exécuter un Shell avec les droits de l’utilisateur « SYSTEM », grâce à l’exploitation d’une faille de type « déréférencement de pointeur nul » au niveau du noyau « win32k.sys ».

Note : la preuve de concept exploite une vulnérabilité corrigée par Microsoft dans le bulletin MS15-010.

* Windows 2008 SP1 (64 bits)
* Windows 2008 R2 SP1 (64 bits)

https://cert.xmco.fr/veille/index.xmco?nv=CXA-2015-0472

* Microsoft Windows Server 2003 SP2 (Edition 32 bits)
– KB3013455 :
https://www.microsoft.com/downloads/details.aspx?familyid=fe0ecad1-75ac-4ab7-aa45-5543d05273f1
– KB3023562:
https://www.microsoft.com/downloads/details.aspx?familyid=C4C0EF03-B8BF-496B-ACFB-F67B6423AACF

* Microsoft Windows Server 2003 SP2 (Edition 64 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=4d61438b-320f-4e33-abcf-2be574c8d3ae
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=E388DC72-BEBA-4782-883F-4229E8B85728

* Microsoft Windows Server 2003 SP2 (Edition Itanium)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=02a89a44-2ae1-439c-914e-84c07b5d9b98
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=2FAE23FB-E967-4FF0-B3B7-190296F64701

* Microsoft Windows Vista SP2 (Edition 32 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=ba4def18-6ab7-4be0-8c2b-c7847dbcc3c7
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=0C97E066-4AE5-4463-ADD9-56D673C47640

* Microsoft Windows Vista SP2 (Edition 64 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=7c60faa5-4cdf-4f84-9d08-4020c7a7632e
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=F6F0D583-8E3C-4C5B-A283-19BA1D806CD0

* Microsoft Windows Server 2008 SP2 (Edition 32 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=72feb647-8a55-40af-b57e-56fc910e1b6d
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=F8E6A270-AC2E-41AD-81AC-DDF93A5EAA5E

* Microsoft Windows Server 2008 SP2 (Edition 64 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=8d30063a-a880-4abe-968e-0642b66c8e9e
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=4E985255-0A9A-40FF-89EB-FC7F1483708B

* Microsoft Windows Server 2008 SP2 (Edition Itanium)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=e141d8ae-42fd-4b67-859b-be7568ca2260
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=787B1A90-1C51-4055-9BF9-960C43CB181F

* Microsoft Windows 7 SP1 (Edition 32 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=28d0b934-d7be-4535-8204-17b6b62837e2
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=75EC557D-4126-42D2-BE02-571B362B79F3

* Microsoft Windows 7 SP1 (Edition 64 bits)
-KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=fba133d2-318a-4006-af5e-27ff2972070a
-KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=1018DC6E-368A-44E2-95AA-2755DCB03185

* Microsoft Windows Server 2008 R2 SP1 (Edition 64 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=83260abd-2f4e-4cf9-8641-9100cef3a9ac
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=E6AA3A53-2F8B-40A4-BEC1-2D679EA1E8A4

Microsoft Windows Server 2008 R2 SP1 (Edition Itanium)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=52b481cf-128f-457c-a234-1e32e41f9144
-KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=F2460A48-A3F0-48E5-9C48-9ADAB41025B7

* Microsoft Windows 8 (Edition 32 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=1106e5b4-0b11-4fe3-9947-4032aafb51f1
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=F8E91303-BA73-4AAC-BCEB-54F5FBD3C504

* Microsoft Windows 8 (Edition 64 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=07A4A653-F007-4041-B64D-1CEABBAB17C3
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=08DB9F45-6A47-4CDC-BB42-E4CCD290888E

* Microsoft Windows 8.1 (Edition 32 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=b587807c-2475-4016-b4da-51e0ef87146c
-KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=D30EEECF-B674-4206-8740-8F73A0A82C95

* Microsoft Windows 8.1 (Edition 64 bits)
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=dd0738c7-7483-4dfa-ad46-fdb16e9a3e92
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=3370DE7C-7A0B-413A-B1E2-250ED540B1A4

* Microsoft Windows Server 2012
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=4f539bf9-4556-471d-927a-b6171439c8ce
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=C5692EF2-8632-477E-A7B8-0CC7A95BFA35

* Microsoft Windows Server 2012 R2
– KB3013455
https://www.microsoft.com/downloads/details.aspx?familyid=cb4f92e9-edb4-4b0b-89e3-d92ac2e386dc
– KB3023562
https://www.microsoft.com/downloads/details.aspx?familyid=FB6A8D24-5A87-4278-951A-A2D18B802869

* Microsoft Windows RT
Windows Update

* Microsoft Windows RT 8.1
Windows Update

Microsoft propose aussi différentes solutions de mitigations :

– Configurer une entrée de Registre permettant de désactiver le mappage de page NULL (Windows 7 uniquement)
– Interdire l’accès à la librairie T2EMBED.DLL

Ces différentes solutions sont décrites en détail sur le site de l’éditeur à l’adresse suivante :
https://technet.microsoft.com/fr-FR/library/security/ms15-010.aspx