CVE-2021-1647 Windows Defender缓冲区溢出导致的任意代码执行漏洞复现

0x01 漏洞概述

Windows Defender是Windows自带的防护软件，其在对可执行文件进行检测时采用模拟执行的策略进行黑白判定，模拟执行分为两个部分：指令模拟和运行环境模拟。其中指令模拟会将程序的响应平台指令（arm/mips/x86等）转换成Defender自己的中间指令，然后运行相应的中间指令来模拟执行该文件；而运行环境模拟则是对内存系统、文件系统、系统API、DLL等进行模拟。

Defender在进行指令模拟的时候遇到带壳的可执行文件会使用内置的一些方法尝试脱壳，目前支持脱壳的方式有Upxw64/Upxw/WExtract/NSPacker/Shrinker/PECompact2/Area51/Crypter1337/Aspack/PKLite/SfxCab/Asprotect 等，这次漏洞所在的就是Asprotect壳的脱壳过程中，当攻击者构造一个带有特殊PE头的可执行文件，Windows Defender检测时就会出发缓冲区溢出漏洞进而导致任意代码执行。

0x02 影响版本

-Microsoft:Microsoft Defender:Windows 8.1 for 32-bit systems
-Microsoft:Microsoft Defender:Windows 7 for x64-based Systems Service Pack 1
-Microsoft:Microsoft Defender:Windows 7 for 32-bit Systems Service Pack 1
-Microsoft:Microsoft Defender:Windows Server 2016 (Server Core installation)
-Microsoft:Microsoft Defender:Windows Server 2016
-Microsoft:Microsoft Defender:Windows 10 Version 1607 for x64-based Systems
-Microsoft:Microsoft Defender:Windows 10 Version 1607 for 32-bit Systems
-Microsoft:Microsoft Defender:Windows 10 for x64-based Systems
-Microsoft:Microsoft Defender:Windows 10 for 32-bit Systems
-Microsoft:Microsoft Defender:Windows Server, version 20H2 (Server Core Installation)
-Microsoft:Microsoft Defender:Windows 10 Version 20H2 for ARM64-based Systems
-Microsoft:Microsoft Defender:Windows 10 Version 20H2 for 32-bit Systems
-Microsoft:Microsoft Defender:Windows 10 Version 20H2 for x64-based Systems
-Microsoft:Microsoft Defender:Windows Server, version 2004 (Server Core installation)
-Microsoft:Microsoft Defender:Windows 10 Version 2004 for x64-based Systems
-Microsoft:Microsoft Defender:Windows 10 Version 2004 for ARM64-based Systems
-Microsoft:Microsoft Defender:Windows 10 Version 2004 for 32-bit Systems
-Microsoft:Microsoft Defender:Windows Server, version 1909 (Server Core installation)
-Microsoft:Microsoft Defender:Windows 10 Version 1909 for ARM64-based Systems
-Microsoft:Microsoft Defender:Windows 10 Version 1909 for x64-based Systems
-Microsoft:Microsoft Defender:Windows 10 Version 1909 for 32-bit Systems
-Microsoft:Microsoft Defender:Windows Server 2019 (Server Core installation)
-Microsoft:Microsoft Defender:Windows Server 2019
-Microsoft:Microsoft Defender:Windows 10 Version 1809 for ARM64-based Systems
-Microsoft:Microsoft Defender:Windows 10 Version 1809 for x64-based Systems
-Microsoft:Microsoft Defender:Windows 10 Version 1809 for 32-bit Systems
-Microsoft:Microsoft Defender:Windows 10 Version 1803 for ARM64-based Systems
-Microsoft:Microsoft Defender:Windows 10 Version 1803 for x64-based Systems
-Microsoft:Microsoft Defender:Windows 10 Version 1803 for 32-bit Systems
-Microsoft:Microsoft System Center 2012 Endpoint Protection
-Microsoft:Microsoft Security Essentials
-Microsoft:Microsoft System Center 2012 R2 Endpoint Protection
-Microsoft:Microsoft System Center Endpoint Protection
-Microsoft:Microsoft Defender:Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
-Microsoft:Microsoft Defender:Windows Server 2008 for 32-bit Systems Service Pack 2
-Microsoft:Microsoft Defender:Windows RT 8.1
-Microsoft:Microsoft Defender:Windows 8.1 for x64-based systems
-Microsoft:Microsoft Defender:Windows Server 2012 R2 (Server Core installation)
-Microsoft:Microsoft Defender:Windows Server 2012 R2
-Microsoft:Microsoft Defender:Windows Server 2012 (Server Core installation)

0x03 环境搭建

1.安装VMware workstation虚拟机（本此复现VMware workstation版本为15版本）

2.在虚拟机上安装 Windows10 1903 靶机（或上述任一受影响版本）

3.下载POC程序

为了确保Windows Defender没有更新（可以采取断网措施防止后续更新）

0x04 漏洞复现

1.启动Windows 10虚拟机；

2.将含有POC程序的压缩包复制到靶机任意位置；

3.直接右键对该文件进行解压；

4.解压后就能弹一个system权限的命令行窗口出来，因为Windows Defender在文件被从压缩包里解压出来的时候就会检查这几个新文件，发现是加壳的可执行文件就会让引擎脱壳，其中的溢出漏洞就会触发，进而达到任意命令执行的目的；

5.同时Windows Defender也会发生崩溃，并在数十秒后自动重新启动。

0x05 防护建议

Windows联网，打开Windows Defender防护中心手动点击更新Windows Defender，并保持Windows自动更新开启，或通过第三方安全防护软件的相关补丁功能进行补丁安装。