Summary

The default configuration in Microsoft Windows 10 v1809 and newer includes an elevation of privilege vulnerability, because of overly permissive Access Control Lists (ACLs) in the Security Accounts Manager (SAM) database, as well as multiple other system files. Upon successful exploitation, an attacker can run arbitrary code with SYSTEM privileges, leading to installation of programs; viewing, changing, or deleting data, or the creation of new accounts with full user rights. Attackers must have the ability to execute code on a victim system to exploit this vulnerability.

At this time, mitigation includes restricting access to Windows configuration files, then deleting VSS shadow copies, as detailed below.

Applies To

• Windows 10 Version 21H1: 32-bit, x64, and ARM64¹
• Windows 10 Version 2004: 32-bit
• Windows 10 Version 1909: 32-bit, x64, and ARM64¹
• Windows 10 Version 1809: 32-bit, x64, and ARM64¹
• Windows Server Core 2019
• Windows Server 2019

How do I see if I’m impacted?

You can run the following from cmd.exe to check the permissions on various hives:

Command Prompt: icacls %windir%\system32\config\SAM
PowerShell: icacls $env:windir\System32\config\SAM

If impacted, the expected output would be as follows:

C:\Users\andrew>icacls C:\Windows\System32\config\SAM
C:\Windows\System32\config\SAM BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

A vulnerable system will report an output indicating the hive is read accessible (RX): BUILTIN\Users:(I)(RX)

What are the current mitigation steps?

Restrict access to the contents of %windir%\system32\config

1. Open Command Prompt or Windows PowerShell as an administrator.
2. Run this command in either:
   • Command Prompt:
     icacls %windir%\system32\config\*.* /inheritance:e
   • PowerShell:
     icacls $env:windir\system32\config\. /inheritance:e

Delete Volume Shadow Copy Service (VSS) shadow copies

Note: This step is a modified version of the Microsoft MSRC article’s guidance.

In order to implement Microsoft’s workaround with our recommended policy settings, use the following PowerShell .PS1 script. This can be run locally on your systems or remotely via Real Time Response.

Get-WmiObject Win32_Shadowcopy | ForEach-Object {
Write-Host “Deleting VSS ” $_.ID.ToLower()
$cmd = “delete shadows /shadow=” + $_.ID.ToLower() + ” /quiet”
Start-Process -FilePath $env:SystemRoot\system32\vssadmin.exe -ArgumentList $cmd -Wait
}

Once you have deleted the VSS shadow copies and restore points, create a new System Restore point if desired.

Impact of workaround: Deleting shadow copies could impact restore operations, including the ability to restore data with third-party backup applications.

Note: You must restrict access and delete shadow copies to prevent exploitation of this vulnerability.

Proof of Concept

Available here or run this command from a non-admin PowerShell prompt:

foreach($i in @(“SYSTEM”,”SAM”)){[System.IO.File]::Copy(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\$i, “$i”)};