# Title: Windows 10 'scrrun.dll' Multiple vulnerabilities # Author: Nassim Asrir # Contact: wassline@gmail.com / https://www.linkedin.com/in/nassim-asrir-b73a57122/ # Vendor: https://www.microsoft.com/ Test ENV: ======== Browser : IE 11 OS: Windows 10 - x64 Details: ======== scrrun.dll (C:\Windows\SysWOW64\scrrun.dll) contains 3 vulnerable functions. 1 - CreateTextFile: With this function the attacker will be able to create text files on the victim machine 2 - CreateFolder: With this function the attacker will be able to create folders on the victim machine 3 - DeleteFolder: And with this the attacker will be able to delete any file system on victim machine like ( bootvid.dll ) or any file or folder on system32 Attack scenario =============== The attacker will not need to use a MITM attack or Social engineering So as a scenario: 1 - The attacker will create a website and he will inject the exploit code on his file (index.php) and if the victime navigate his website he will be affected with malicious code. 2 - The attacker will be able to target big organization because this dll is installed by default on Windows so any Windows OS is affected . 3 - The attacker will be able to affect lots of people by sharing his link via Any social website or in chat room. Impact: ===== So as i said first there a vulnerable function named 'DeleteFolder' and using this function the attacker will be able to delete any file or folder on victime machine and if the attacker targeted intersting files in system32 folder the victime will loss his machine. Exploits: ========= 1- CreateTextFile function ========================== ; Attributes: bp-based frame ; int __stdcall CFileSystem__CreateTextFile(int, BSTR, int, unsigned __int16 *, __int16) ?CreateTextFile@CFileSystem@@UAGJPAGFFPAPAUITextStream@@@Z proc near var_110= dword ptr -110h Memory= dword ptr -10Ch var_108= byte ptr -108h var_4= dword ptr -4 arg_4= dword ptr 0Ch arg_8= dword ptr 10h arg_C= dword ptr 14h arg_10= word ptr 18h ; FUNCTION CHUNK AT .text:1000BF9D SIZE 0000005E BYTES mov edi, edi push ebp mov ebp, esp sub esp, 110h mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push esi mov esi, dword ptr [ebp+arg_10] push edi mov edi, [ebp+arg_4] test esi, esi jz short loc_10009700 Note: I used the 'onload Event' to work the exploit automatically. This function contain 3 args and the attacker will be able to control the value: Function CreateTextFile ( ByVal FileName As String , ByVal Overwrite As Boolean , ByVal Unicode As Boolean ) in our poc we controlled the FileName Parameter. scrrun.dll Multiple Vulnerabilities 2- CreateFolder Function: ========================= ; Attributes: bp-based frame ; int __fastcall DoCreateFolder(LPCWSTR lpPathName) ?DoCreateFolder@@YGJPBGPAPAUIFolder@@@Z proc near var_4= byte ptr -4 mov edi, edi push ebp mov ebp, esp push ecx push esi push edi mov edi, edx mov esi, ecx call ?IsUNC@@YGHPBG@Z ; IsUNC(ushort const *) test eax, eax jz short loc_1001AB21 This function contain one paramter and also the attacker will be able to control it. Function CreateFolder ( ByVal Path As String ) As IFolder This exploit will create a folder named 'test' on Desktop. scrrun.dll Multiple Vulnerabilities 3- DeleteFolder function ======================== .text:1001AC24 .text:1001AC24 ; Attributes: bp-based frame .text:1001AC24 .text:1001AC24 ; int __fastcall DoDeleteFolder(wchar_t *Src) .text:1001AC24 ?DoDeleteFolder@@YGJPBGH@Z proc near ; CODE XREF: CFileSystem::DeleteFolder(ushort *,short)+3Ap .text:1001AC24 ; FolderObject::Delete(short)+2Fp .text:1001AC24 .text:1001AC24 var_488 = byte ptr -488h .text:1001AC24 var_484 = dword ptr -484h .text:1001AC24 var_480 = dword ptr -480h .text:1001AC24 var_474 = dword ptr -474h .text:1001AC24 var_470 = dword ptr -470h .text:1001AC24 Memory = dword ptr -46Ch .text:1001AC24 var_468 = byte ptr -468h .text:1001AC24 var_260 = dword ptr -260h .text:1001AC24 var_25C = dword ptr -25Ch .text:1001AC24 var_258 = dword ptr -258h .text:1001AC24 var_4 = dword ptr -4 .text:1001AC24 .text:1001AC24 mov edi, edi .text:1001AC26 push ebp .text:1001AC27 mov ebp, esp .text:1001AC29 sub esp, 488h .text:1001AC2F mov eax, ___security_cookie .text:1001AC34 xor eax, ebp .text:1001AC36 mov [ebp+var_4], eax .text:1001AC39 push ebx .text:1001AC3A mov [ebp+var_484], edx .text:1001AC40 mov ebx, ecx .text:1001AC42 push edi .text:1001AC43 lea edx, [ebp+var_488] .text:1001AC49 call ?GetNameSubstring@@YGPBGPBGPAH@Z ; GetNameSubstring(ushort const *,int *) .text:1001AC4E mov edi, eax .text:1001AC50 test edi, edi .text:1001AC52 This function is the dangerous function with this exploit the attacker will be able to delete any file or folder on victim machine also on system32 folder. This exploit will delete a folder named test scrrun.dll Multiple Vulnerabilities #EOF and thnks for reading my report.