Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MSI Center – How to gain SYSTEM privileges in seconds

mrbruh.com

Post reply on HN
Print view View original

51–60 of 68 posts

Re: MSI Center – How to gain SYSTEM privileges in seconds

#51

Post by eknkc »

zipy124 wrote: post #39

MSI Center is one of the worst pieces of software that I can't get rid of. Some features I can't find easy ways to replicate such as controlling the fan/GPU/CPU profiles and battery charging. Updating the software takes FOREVER for what should be fairly simple, and it is extremely slow again for what should be simple software.

Last year I built a new computer and made sure that I'd not use a single piece of hardware that will require some shit software from the manufacturer.

I'm really happy with my absolutely no RGB, AIO controlled with a pump header boring PC.

Re: MSI Center – How to gain SYSTEM privileges in seconds

#52

Post by dist-epoch »

nicman23 wrote: post #42
dist-epoch wrote: post #36

Earlier quoted context omitted.

I don't think you thought this through. does this also apply to individual developers? should Linux Torvalds or the ffmpeg developers go to jail if they merge a RCE zero-day into the Linux kernel or into ffmpeg?

gross negligence / honest mistake if you cannot differentiate the 2, :insert rude thing here:

ok, so you agree that if Linus merges code due to gross negligence, for example he was warned in an email that it contains a RCE and he laughs it off, and still merges it, he should go to jail

glad you are consistent in your beliefs

Re: MSI Center – How to gain SYSTEM privileges in seconds

#53

Post by mike_hock »

Klathmon wrote: post #50
mike_hock wrote: post #46

Earlier quoted context omitted.

Is there a valid reason to use any encryption at all if you generally can't sniff the traffic unless you can also sniff the key, and if the key is arbitrary and not verified against anything?

AES is so cheap with hardware acceleration that I could see an argument that it prevents casual sniffing of the traffic. Personally I think the false sense of security would outweigh those benefits, but I'm not in their shoes. But DES is so broken that it's more of a giant flashing beacon saying "look here there are terrible decisions being made!"

What casual sniffing? It's a pipe. If you can sniff that, you can sniff all the traffic because the very first message is the key in plaintext.

Re: MSI Center – How to gain SYSTEM privileges in seconds

#54

Post by kjs3 »

eknkc wrote: post #51
zipy124 wrote: post #39

MSI Center is one of the worst pieces of software that I can't get rid of. Some features I can't find easy ways to replicate such as controlling the fan/GPU/CPU profiles and battery charging. Updating the software takes FOREVER for what should be fairly simple, and it is extremely slow again for what should be simple software.

Last year I built a new computer and made sure that I'd not use a single piece of hardware that will require some shit software from the manufacturer. I'm really happy with my absolutely no RGB, AIO controlled with a pump header boring PC.

This is the way...

Re: MSI Center – How to gain SYSTEM privileges in seconds

#55

Post by basilikum »

everyflavourvms wrote: post #38
ashikns wrote: post #23

Earlier quoted context omitted.

Video by GN has a little bit of info (but not a lot). Basically they made it so that the pipes only accept input from MSI signed software + the pipes can only invoke MSI signed executables. https://youtu.be/Eck8NnoaD4M

> pipes only accept input from MSI signed software This does not inspire confidence. I'm assuming the pipe exists so that some GUI process running as the current user can perform privileged actions since the other end of the pipe runs as SYSTEM. At this point, just inject a thread into that GUI process and send the command - the service will think it is coming from MSI software, because it is. The "only invoke MSI si…

> At this point, just inject a thread into that GUI process and send the command

Can you or someone else expand on that?

Re: MSI Center – How to gain SYSTEM privileges in seconds

#56

Post by drdexebtjl »

basilikum wrote: post #55
everyflavourvms wrote: post #38

Earlier quoted context omitted.

> pipes only accept input from MSI signed software This does not inspire confidence. I'm assuming the pipe exists so that some GUI process running as the current user can perform privileged actions since the other end of the pipe runs as SYSTEM. At this point, just inject a thread into that GUI process and send the command - the service will think it is coming from MSI software, because it is. The "only invoke MSI si…

> At this point, just inject a thread into that GUI process and send the command Can you or someone else expand on that?

Sure. On Windows, you can allocate memory into an arbitrary process’s address space with VirtualAllocEx, write arbitrary code into those allocated pages using WriteProcessMemory, and start a thread there with CreateRemoteThread.

Now, of course you can’t do this for every process, or it would be trivial to escalate privileges. But I’m pretty sure you can do this for child processes running as the same user.

Re: MSI Center – How to gain SYSTEM privileges in seconds

#57

Post by everyflavourvms »

drdexebtjl wrote: post #56
basilikum wrote: post #55

Earlier quoted context omitted.

> At this point, just inject a thread into that GUI process and send the command Can you or someone else expand on that?

Sure. On Windows, you can allocate memory into an arbitrary process’s address space with VirtualAllocEx, write arbitrary code into those allocated pages using WriteProcessMemory, and start a thread there with CreateRemoteThread. Now, of course you can’t do this for every process, or it would be trivial to escalate privileges. But I’m pretty sure you can do this for child processes running as the same user.

Yep. There's a system of ACLs and integrity levels which determine whether you're allowed to do this or not (doesn't have to be a child process), but for the most common case:

* a process running at medium integrity level with the current user's token

* another medium integrity process with the same token can open it with PROCESS_CREATE_THREAD and PROCESS_VM_WRITE rights

Re: MSI Center – How to gain SYSTEM privileges in seconds

#58

Post by everyflavourvms »

drdexebtjl wrote: post #48
everyflavourvms wrote: post #38

Earlier quoted context omitted.

> pipes only accept input from MSI signed software This does not inspire confidence. I'm assuming the pipe exists so that some GUI process running as the current user can perform privileged actions since the other end of the pipe runs as SYSTEM. At this point, just inject a thread into that GUI process and send the command - the service will think it is coming from MSI software, because it is. The "only invoke MSI si…

I don’t think “only invoke MSI signed executables” inspires confidence either. There’s ought to be an MSI signed executable that launches arbitrary executables by design and defeats the mitigation. The author got around a similar mitigation in their exploit for ASUS DriverHub (linked in the original article).

Oh right, yes, either that, or one of them is bound to have a DLL hijack issue that can be taken advantage of.

Re: MSI Center – How to gain SYSTEM privileges in seconds

#59

Post by drdexebtjl »

everyflavourvms wrote: post #58
drdexebtjl wrote: post #48

Earlier quoted context omitted.

I don’t think “only invoke MSI signed executables” inspires confidence either. There’s ought to be an MSI signed executable that launches arbitrary executables by design and defeats the mitigation. The author got around a similar mitigation in their exploit for ASUS DriverHub (linked in the original article).

Oh right, yes, either that, or one of them is bound to have a DLL hijack issue that can be taken advantage of.

Or just a TOCTOU race :)

Re: MSI Center – How to gain SYSTEM privileges in seconds

#60

Post by Pxtl »

pjmlp wrote: post #16
indrora wrote: post #15

Earlier quoted context omitted.

Unfortunately, WiX is still a pain in the ass to use and there's a lot of simple tooling that makes NSIS/InnoSetup/etc shockingly easy to use while the same MSI experience is garbage. msix is just a different beast entirely too.

What about using the Visual Studio packaging tools? I live on .NET/C++ universe in regards to Windows development, so it might be it isn't as nice for not blessed stacks.

Didn't they discontinue those around VS 2015 or so? Its been a while since I tried. Iirc that's what got replaced with WiX and ClickOnce, both of which are 100X more complicated to use.
Post reply on HN