exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Microsoft Windows Containers Privilege Escalation

Microsoft Windows Containers Privilege Escalation
Posted Mar 10, 2021
Authored by James Forshaw, Google Security Research

The standard user ContainerUser in a Windows Container has elevated privileges and High integrity level which results in making it administrator equivalent even though it should be a restricted user.

tags | exploit
systems | windows
advisories | CVE-2021-26891
SHA-256 | b317a2978a717df92a18c59b704df44df5773c6029128d2cc21c45a42ecce392

Microsoft Windows Containers Privilege Escalation

Change Mirror Download
Windows Containers: ContainerUser has Elevated Privileges

Windows Containers: ContainerUser has Elevated Privileges
Platform: Windows 10 20H2 (not tested other versions)
Class: Elevation of Privilege
Security Boundary: User

Summary:
The standard user ContainerUser in a Windows Container has elevated privileges and High integrity level which results in making it administrator equivalent even though it should be a restricted user.

Description:
Windows Containers setup two default user accounts, which are created by the CExecSvc service. The first user, ContainerAdministrator is a full administrator. The second user, ContainerUser you would assume is not supposed to be an administrator. However, both users are created as virtual service accounts, this results in ContainerUser being granted SeImpersonatePrivilege, SeCreateGlobalPrivilege and runs with a High integrity level.

At a minimum having SeImpersonatePrivilege is considered administrator equivalent. You can use public exploits such as RogueWinRM (https://github.com/antonioCoco/RogueWinRM) to get SYSTEM from ContainerUser, but I'm sure there are other techniques to do the same thing.

For example the following is the output from a ServerCore 20H2 image running in Hyper-V (but the container isolation doesn't seem to matter).

C:\\> ver
Microsoft Windows [Version 10.0.19042.685]

C:\\> whoami /groups /priv
GROUP INFORMATION
-----------------

Group Name Type SID Attributes
==================================== ================ ============ ==================================================
Mandatory Label\\High Mandatory Level Label S-1-16-12288
...

PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled

The issue is as far as I understand it ContainerUser should not be administrator equivalent otherwise there seems little point to have two separate users. I'd recommend ensuring SeCreateGlobalPrivilege is also removed, while it's not as easy to exploit it could still provide a means of compromising the container. Also the CExecSvc looks to be code written and signed by Microsoft so I assume it's in scope as a Microsoft product.

Proof of Concept:

I just installed Docker Desktop on Windows 10 20H2. Then ran the command:
C:\\> docker run --user=ContainerUser -it mcr.microsoft.com/windows/servercore:20H2

Then in the container I ran the following command to display the user's details.
C:\\> whoami /groups /priv

Expected Result:
The ContainerUser does not have elevated privileges.

Observed Result:
The ContainerUser has SeImpersonatePrivilege.

This bug is subject to a 90 day disclosure deadline. After 90 days elapse,
the bug report will become visible to the public. The scheduled disclosure
date is 2021-03-14. Disclosure at an earlier date is also possible if
agreed upon by all parties.


Related CVE Numbers: CVE-2021-26891.



Found by: forshaw@google.com

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close