一. 漏洞介绍
microsoft 的MS04-020公告描述了POSIX子系统的权限提升漏洞,公告地址:
http://www.microsoft.com/technet/security/bulletin/MS04-020.mspx
CVE 公告:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0210

很明显,这是一个本地权限提升的漏洞,存在于POSIX子系统中.
二. 漏洞分析
microsoft的POSIX系统由一个psxss的进程负责处理, posix.exe运行起来的程序会通过LPC来和psxss通讯,
psxss进程的权限是SYSTEM, 很不幸的是,posix.exe传递给psxss的数据中,如果包含过长的字符串会导致psxss一个
堆栈溢出,如果我们精心构造这些字符串,很明显会得到SYSTEM权限的控制权.
出问题的地方在psxss.exe的在sub_4A7861BE处:
+----------------------------------------------------------------------------------+
.text:4A7861BE sub_4A7861BE proc near ; CODE XREF: sub_4A785BBC+175p
.text:4A7861BE
.text:4A7861BE var_500 = dword ptr -500h
.text:4A7861BE var_400 = dword ptr -400h
.text:4A7861BE var_201 = byte ptr -201h
.text:4A7861BE var_200 = dword ptr -200h
.text:4A7861BE arg_0 = dword ptr 8
.text:4A7861BE arg_4 = dword ptr 0Ch
.text:4A7861BE
.text:4A7861BE push ebp
.text:4A7861BF mov ebp, esp
.text:4A7861C1 sub esp, 500h
.text:4A7861C7 push ebx
.text:4A7861C8 push esi
.text:4A7861C9 push edi
.text:4A7861CA mov eax, large fs:18h
.text:4A7861D0 mov eax, [eax+30h]
.text:4A7861D3 cmp dword ptr [eax+1D4h], 0
.text:4A7861DA jz short loc_4A78620B  ;这里会跳转
.text:4A7861DC mov eax, large fs:18h
.text:4A7861E2 mov eax, [eax+30h]
.text:4A7861E5 push offset dword_4A7814A4
.text:4A7861EA push dword ptr [eax+1D4h]
.text:4A7861F0 lea eax, [ebp+var_200]
.text:4A7861F6 push offset aSessions_0 ; "\\Sessions"
.text:4A7861FB push offset aSDS ; "%s\\%d%s"
.text:4A786200 push eax
.text:4A786201 call _sprintf
.text:4A786206 add esp, 14h
.text:4A786209 jmp short loc_4A78621A
.text:4A78620B ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
.text:4A78620B
.text:4A78620B loc_4A78620B: ; CODE XREF: sub_4A7861BE+1Cj
.text:4A78620B mov esi, offset dword_4A7814A4
.text:4A786210 lea edi, [ebp+var_200]
.text:4A786216 movsd
.text:4A786217 movsd
.text:4A786218 movsd
.text:4A786219 movsb
.text:4A78621A
.text:4A78621A loc_4A78621A: ; CODE XREF: sub_4A7861BE+4Bj
.text:4A78621A mov eax, [ebp+arg_4]
.text:4A78621D or ebx, 0FFFFFFFFh
.text:4A786220 mov ecx, ebx
.text:4A786222 lea edx, [ebp+var_200]
.text:4A786228 mov edi, [eax+4]  ;eax+4是LPC传递过来的数据
.text:4A78622B xor eax, eax
.text:4A78622D repne scasb
.text:4A78622F not ecx    ;计算大小
.text:4A786231 sub edi, ecx
.text:4A786233 mov esi, edi