.NET Information center: [Full-disclosure] %windir%\temp\sso\ssoexec.dll (or: how trustworthy is Microsoft's build process)

Wednesday, March 07, 2012

[Full-disclosure] %windir%\temp\sso\ssoexec.dll (or: how trustworthy is Microsoft's build process)

Hi @ll,

the system image "\Setup\WIM\setup.wim" on the "POSReady 2009 eval CD",

available from the Microsoft Download Center under

<http://www.microsoft.com/downloads/en/details.aspx?FamilyID=1e077ece-3f19-4c41-b219-6fcc821fb5fc>,

contains the following registry entries:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SSOExec]

"Asynchronous"=dword:00000001

"Impersonate"=dword:00000001

"Logoff"="SSOReset"

"Unlock"="SSOExec"

"Lock"="SSOReset"

"DLLName"="%windir%\\temp\\sso\\ssoexec.dll"

The directory "%windir%\temp" in the system image is but empty.

The presence of these registry entries is evidence that (one of) the system(s) used to build and capture the POSReady 2009 evaluation system image were infested with malware, and that either the infestation was not detected at all (bad) or the infestation was detected, but incompletely (or accidentially, when "%windir%\temp" was cleared) "removed" and a compromised system used to build the system image (worse).

JFTR: MSFT initiated their "trustworthy computing" about 10 years ago!

To complete the picture: the ACLs on the directory "%windir%\temp" in systems installed from this image/CD allow unprivileged users to create a subdirectory "sso" in "%windir%\temp" and then the "ssoexec.dll", allowing them to have their code run under every (other) user account used to log on afterwards, resulting in a privilege escalation.