GitBook: [#3069] No subject

windows/windows-local-privilege-escalation/leaked-handle-exploitation.md

@@ -1,9 +1,43 @@
 # Leaked Handle Exploitation
 
-Imagine that **a process running as SYSTEM open a new process** (`OpenProcess()`) with **full access**. The same process **also create a new process** (`CreateProcess()`) **with low privileges but inheriting all the open handles of the main process**.\
+## Introduction
+
+Handles in a process allow to **access** different **Windows resources**:
+
+![](<../../.gitbook/assets/image (663).png>)
+
+There have been already several **privilege escalation** cases where a **privileged process** with **open and inheritable handles** have **run** an **unprivileged process** giving it **access to all those handles**.
+
+For example, imagine that **a process running as SYSTEM open a new process** (`OpenProcess()`) with **full access**. The same process **also creates a new process** (`CreateProcess()`) **with low privileges but inheriting all the open handles of the main process**.\
 Then, if you have **full access to the low privileged process**, you can grab the **open handle to the privileged process created** with `OpenProcess()` and **inject a shellcode**.
 
-**The code of this example was shared by an anonymous person.**
+## **Interesting Handles**
+
+### **Process**
+
+As you read on the initial example if an **unprivileged process inherits a process handle** of a **privileged process** with enough permissions it will be able to execute **arbitrary code on it**.
+
+In [**this excellent article**](http://dronesec.pw/blog/2019/08/22/exploiting-leaked-process-and-thread-handles/) you can see how to exploit any process handle that has any of the following permissions:
+
+* PROCESS\_ALL\_ACCESS
+* PROCESS\_CREATE\_PROCESS
+* PROCESS\_CREATE\_THREAD
+* PROCESS\_DUP\_HANDLE
+* PROCESS\_VM\_WRITE
+
+### Thread
+
+Similar to the process handles, if an **unprivileged process inherits a thread handle** of a **privileged process** with enough permissions it will be able to execute **arbitrary code on it**.
+
+In [**this excellent article**](http://dronesec.pw/blog/2019/08/22/exploiting-leaked-process-and-thread-handles/) you can also see how to exploit any process handle that has any of the following permissions:
+
+* THREAD\_ALL\_ACCESS
+* THREAD\_DIRECT\_IMPERSONATION
+* THREAD\_SET\_CONTEXT
+
+### File & Key
+
+If an **unprivileged process inherits** a **handle** with **write** equivalent **permissions** over a **privileged file or registry**, it will be able to **overwrite** the file/registry (and with a lot of **luck**, **escalate privileged**).
 
 ## Vulnerable Example
 
@@ -217,7 +251,7 @@ int _tmain( int argc, TCHAR* argv[] )
 }
 ```
 
-## Exploit Example 1
+### Exploit Example 1
 
 {% hint style="info" %}
 In a real scenario you probably **won't be able to control the binary** that is going to be executed by the vulnerable code (_C:\users\username\desktop\client.exe_ in this case). Probably you will **compromise a process and you will need to look if you can access any vulnerable handle of any privileged process**.
@@ -430,7 +464,7 @@ int main(int argc, char **argv) {
 }
 ```
 
-## Exploit Example 2
+### Exploit Example 2
 
 {% hint style="info" %}
 In a real scenario you probably **won't be able to control the binary** that is going to be executed by the vulnerable code (_C:\users\username\desktop\client.exe_ in this case). Probably you will **compromise a process and you will need to look if you can access any vulnerable handle of any privileged process**.
@@ -600,3 +634,19 @@ int main(int argc, char **argv) {
     return 0;
 }
 ```
+
+## Other tools and examples
+
+* [**https://github.com/lab52io/LeakedHandlesFinder**](https://github.com/lab52io/LeakedHandlesFinder)****
+
+This tool allows you to monitor leaked handles to find vulnerable ones and even auto-exploit them. It also has a tool to leak one.
+
+* [**https://github.com/abankalarm/ReHacks/tree/main/Leaky%20Handles**](https://github.com/abankalarm/ReHacks/tree/main/Leaky%20Handles)****
+
+Another tool to leak a handle and exploit it.
+
+## References
+
+* [http://dronesec.pw/blog/2019/08/22/exploiting-leaked-process-and-thread-handles/](http://dronesec.pw/blog/2019/08/22/exploiting-leaked-process-and-thread-handles/)
+* [https://github.com/lab52io/LeakedHandlesFinder](https://github.com/lab52io/LeakedHandlesFinder)
+* [https://googleprojectzero.blogspot.com/2016/03/exploiting-leaked-thread-handle.html](https://googleprojectzero.blogspot.com/2016/03/exploiting-leaked-thread-handle.html)