Analysis of Serious Vulnerabilities in Microsoft Windows System: Potential Threats to Web3 Security

Last month, Microsoft released a security patch that fixed a Windows privilege escalation vulnerability being exploited by hackers. This vulnerability only affects earlier versions of Windows systems and cannot be triggered on Windows 11. This article will analyze how attackers continue to exploit this vulnerability in the context of increasingly strengthened security measures.

The analysis process was completed in a Windows Server 2016 environment. These types of undisclosed system vulnerabilities are commonly referred to as "zero-day vulnerabilities", which can be maliciously exploited by hackers without detection, causing significant harm. The recently discovered Windows system-level vulnerability allows hackers to gain full control of the system, thereby stealing personal information, implanting malware, and causing system crashes, among other issues. In severe cases, it could jeopardize the entire Web3 ecosystem based on Web2 infrastructure.

By analyzing the patch, the issue lies in the locking mechanism for window objects and menu objects in the win32k code. The early code only locked the window objects without locking the associated menu objects, which could lead to incorrect references to the menu objects.

To reproduce this vulnerability, we constructed a special multi-layer nested menu structure and deleted the reference relationships between some menus at a critical moment. This way, when the kernel function returns to the user layer, a certain menu object will be released, causing subsequent kernel functions to incorrectly reference an invalid object.

Exploitation mainly consists of two steps: first, control the window extension data size using the released object, and then use this extended data to achieve stable memory read and write. We achieved the first write by carefully designing the memory layout and utilizing the data between adjacent objects.

Ultimately, we achieved stable arbitrary memory read and write, which can be used to replace process tokens for privilege escalation. The entire exploitation process mainly relies on the leakage of desktop heap handle addresses, which still poses a security risk for older systems.

Overall, although Microsoft is refactoring the win32k code with Rust to eliminate such vulnerabilities, threats to existing systems still exist. In the future, detection of abnormal memory operations should be strengthened to identify similar vulnerabilities. Additionally, the issue of desktop heap handle address leakage needs to be thoroughly resolved to enhance the overall security of the system.