Windows PsExec Zero-Day Vulnerability Gets A Free Micropatch

A free micropatch fixing a local privilege escalation (LPE) vulnerability in Microsoft’s Windows PsExec management tool is now available through the 0patch platform.

PsExec is a fully interactive telnet-replacement that allows system admins to execute programs on remote systems. PsExec tool is also integrated into and used by enterprise tools to remotely launch executables on other computers.

This PsExec zero-day is caused by a named pipe hijacking (also known as named pipe squatting) vulnerability which allows attackers to trick PsExec into re-opening a maliciously created named pipe and giving it Local System permissions.

After successfully exploiting the bug, threat actors will be able to execute arbitrary processes as Local System which effectively allows them to take over the machine.

Any Windows computer where “admins remotely launch executables on using PsExec (or management tools utilizing PsExec) if the machine already has a non-admin attacker there trying to elevate their privileges” is vulnerable to attacks attempting to exploit this zero-day as ACROS Security CEO and 0patch co-founder Mitja Kolsek explains.

Also Read: How a Smart Contract Audit Works and Why it is Important

Affects PsExec versions released during the last 14 years

Tenable malware researcher David Wells discovered the vulnerability and publicly disclosed it on December 9th, 2020, 90 days after Microsoft was informed and failed to patch the bug.

“This local privilege escalation allows a non-admin process to escalate to SYSTEM if PsExec is executed locally or remotely on the target machine,” Wells explains.

While researching the vulnerability and creating a proof-of-concept, Wells was able to confirm that the zero-say affects multiple Windows versions from Windows XP up to Windows 10.

He also found that it impacts multiple PsExec version, starting with v1.72 released back in 2006 and ending with PsExec v2.2, the latest version released almost four years, which means that the zero-day affects all PsExec versions launched during the last 14 years.

A video demo showing how the micropatch released by 0patch prevents exploitation of this zero-day on Windows systems running PsExec is embedded below.

Micropatch only applies to the latest PsExec release

Kolsek says that the free micropatch released today is delivered in memory and requires no system restart.

It applies to the latest 32-bit and 64-bit PsExec version, but it might be ported to older PsExec versions depending on users’ feedback as Kolsek tweeted earlier today.

“This vulnerability allows an attacker who can already run code on your remote computer as a non-admin (e.g., by logging in as a regular Terminal Server user, or establishing an RDP session as a domain user, or breaking into a vulnerable unprivileged service running on the remote computer) to elevate their privileges to Local System and completely take over the machine as soon as anyone uses PsExec against that machine,” Kolsek said.

Also Read: Data Centre Regulations Singapore: Does It Help To Progress?

“For home users and small businesses, this is probably not a high-priority threat, while for large organizations it may be.”