‘Microsoft Windows Utility Manager Vulnerability (MS04-11)’
‘A local elevation of privileges vulnerability exists on the Windows Utility Manager that allows to any user to take complete control over the operating system.’
‘The information has been provided by Vivek Rathod (Application Security, Inc.).’
‘Microsoft Windows 2000 contains support for Accessibility options within the operating system. Accessibility support is a series of human-assisting technologies within Windows that allow users with disabilities to still be able to access the functions of the operating system. Accessibility support is enabled or disabled through shortcuts built into the operating system, or through the Accessibility Utility Manager. The Utility Manager is an accessibility utility that allows users to check the status of Accessibility programs (Magnifier, Narrator, On-Screen Keyboard) and start or stop them. The Utility Manager can be invoked by pressing Windows Key + U or executing ‘utilman.exe /start’ from the command line. The Utility Manager Service is enabled by default and runs in the interactive desktop with Local System privileges.
The Utility Manager has support for context sensitive help. Users can access this by clicking in the ‘?’ on the title bar and then on an object or by pressing the F1 key after selecting an object. In order to display the help, Utility Manager loads winhlp32.exe but does not drop System privileges. Therefore, winhlp32.exe is executed under the Local System account. While winhlp32.exe is executing it is possible to send Windows messages to it and attack it with ‘Shatter’ style attacks.
Winhlp32.exe is executed with its main window hidden but it is very trivial to make it visible. Once the window is made visible, a typical attack would involve using the ‘File Open’ dialog to execute a program such as ‘cmd.exe.’ Since the Help window has Local System privileges, the executed program will have the same privileges.