8.4 Windows Patch Management, Local Security & Common Services

8.4 Windows Patch Management, Local Security & Common Services

Enterprise Windows assessment requires evaluating not only Active Directory domain architecture and network authentication protocols, but also local host configurations, patch management posture, and common enterprise server roles. In the CREST Practitioner Security Analyst (CPSA) technical syllabus, candidates are expected to demonstrate knowledge of legacy and modern Microsoft vulnerability identifiers, recognize misconfigurations that permit local privilege escalation, and evaluate the security controls protecting Remote Desktop, Internet Information Services (IIS), and Microsoft Exchange.

---

Windows Patch Management & Vulnerability Tracking

1. Patch Management Architecture

In enterprise networks, managing operating system updates is conducted centrally to prevent bandwidth saturation and ensure operational stability:

• Windows Server Update Services (WSUS): An on-premises update repository that downloads patches from Microsoft Update and distributes them to enterprise workstations and servers via Group Policy Object (GPO) configuration.
• Microsoft Endpoint Configuration Manager (MECM / SCCM): Provides comprehensive patch orchestration, compliance reporting, and software distribution.
• Patch Cadence: Microsoft releases security patches on "Patch Tuesday" (the second Tuesday of each month). Out-of-band (OOB) patches are issued emergency updates reserved for critical, actively exploited zero-day vulnerabilities.

2. Vulnerability Tracking Nomenclature

Security analysts evaluate patches using two historical naming formats:

• Legacy Security Bulletins (MSYY-NNN): Utilized by Microsoft until early 2017. Formatted as MS followed by the two-digit year and a three-digit sequential number (e.g., MS08-067, MS17-010).
• Modern Tracking (CVE & KB Numbers): Microsoft deprecated Security Bulletins in favor of the industry-standard Common Vulnerabilities and Exposures (CVE) nomenclature (e.g., CVE-2019-0708) paired with specific Knowledge Base (KB) article numbers (e.g., KB4013389). A single KB update frequently addresses multiple CVEs.

3. Landmark Windows Vulnerabilities Tested on CPSA

+-----------------------------------------------------------------------------+
|                   CRITICAL HISTORICAL WINDOWS VULNERABILITIES               |
+-----------------------------------------------------------------------------+
| MS08-067 (CVE-2008-4250) : Server Service NetprPathCanonicalize Overflow    |
|                            Unauthenticated SYSTEM RCE via SMB (TCP 445/139) |
|                                                                             |
| MS17-010 (CVE-2017-0144) : EternalBlue SMBv1 srv.sys FEA Buffer Overflow   |
|                            Unauthenticated SYSTEM RCE via SMB (TCP 445)     |
|                                                                             |
| BlueKeep (CVE-2019-0708) : RDP termdd.sys Pre-Auth Use-After-Free          |
|                            Unauthenticated SYSTEM RCE via RDP (TCP 3389)    |
|                                                                             |
| Zerologon (CVE-2020-1472): Netlogon AES-CFB8 Fixed All-Zero IV Flaw         |
|                            Unauthenticated Domain Admin Takeover via RPC    |
|                                                                             |
| PrintNightmare (CVE-2021): Spooler RpcAddPrinterDriverEx Arbitrary DLL Load |
|                            Authenticated SYSTEM RCE / Privilege Escalation  |
+-----------------------------------------------------------------------------+

A. MS08-067 (CVE-2008-4250, Server Service Buffer Overflow)

• Affected Systems: Windows 2000, Windows XP, Windows Server 2003.
• Root Cause: A stack-based buffer overflow in netapi32.dll inside the Server Service during the parsing of relative directory traversal paths (..\) in the RPC function NetprPathCanonicalize.
• Impact: Unauthenticated remote code execution as NT AUTHORITY\SYSTEM over SMB TCP port 445 or 139. Weaponized by the historic Conficker worm.

B. MS17-010 (CVE-2017-0144, "EternalBlue")

• Affected Systems: Windows Vista through Windows 10, Windows Server 2008 through 2016.
• Root Cause: A mathematical integer error in the SMBv1 driver srv.sys when calculating the allocation buffer size for File Extended Attribute (FEA) lists received in SMB_COM_TRANSACTION2 secondary requests.
• Impact: Complete unauthenticated remote code execution with SYSTEM privileges over TCP port 445. Utilized in global ransomware outbreaks including WannaCry and NotPetya.

C. BlueKeep (CVE-2019-0708, Remote Desktop Protocol Pre-Auth RCE)

• Affected Systems: Windows XP, Windows 7, Windows Server 2003, Windows Server 2008 / 2008 R2.
• Root Cause: A pre-authentication use-after-free vulnerability in the RDP kernel driver termdd.sys. An attacker sends malformed channel binding requests targeting the internal MS_T120 channel, leading to kernel memory corruption.
• Impact: Remote code execution at the kernel level without authentication. Completely mitigated by enabling Network Level Authentication (NLA).

D. Zerologon (CVE-2020-1472, Netlogon Protocol Privilege Escalation)

• Affected Systems: All Windows Server versions operating as Active Directory Domain Controllers.
• Root Cause: A cryptographic implementation failure in the Netlogon Remote Protocol (ComputeNetlogonCredential). The protocol implemented the AES-CFB8 block cipher mode with a fixed, static Initialization Vector (IV) consisting of 16 zero bytes (0x00 * 16).
• Mathematical Flaw: When encrypting an all-zero plaintext using an all-zero IV under AES-CFB8, there is a 1-in-256 ($2^8$) probability that the resulting ciphertext is also entirely zeros.
• Impact: An unauthenticated attacker transmitting roughly 256 authentication attempts consisting of zero bytes can authenticate as the Domain Controller's computer account (DC$) and reset its password in Active Directory to empty strings, achieving immediate, complete domain compromise.

E. PrintNightmare (CVE-2021-34527 & CVE-2021-1675)

• Affected Systems: All Windows client and server platforms.
• Root Cause: Insecure design in the Windows Print Spooler service (spoolsv.exe). The RPC function RpcAddPrinterDriverEx() permitted authenticated clients to register printer drivers and specify remote DLL files hosted on an SMB share without adequate privilege validation.
• Impact: Allows any authenticated domain user to achieve remote code execution as NT AUTHORITY\SYSTEM on any host running the Print Spooler service, including Domain Controllers.

---

Windows Local Privilege Escalation & Misconfigurations

Once an attacker obtains a low-privileged command shell on a Windows endpoint, local misconfigurations frequently allow immediate escalation to NT AUTHORITY\SYSTEM.

1. Unquoted Service Paths

• Mechanics: Windows services execute binaries registered under the registry key HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\ImagePath.
• If a service binary path contains space characters and is not enclosed within quotation marks, the Windows Service Control Manager (SCM) cannot determine where the executable path ends and where command-line arguments begin.
• Evaluation Order: SCM evaluates spaces as potential argument delimiters from left to right:

  Path: C:\Program Files\Enterprise Monitor\Sub Folder\service.exe
  
  1. C:\Program.exe
  2. C:\Program Files\Enterprise.exe
  3. C:\Program Files\Enterprise Monitor\Sub.exe
  4. C:\Program Files\Enterprise Monitor\Sub Folder\service.exe (Intended)
  

• Exploitation Condition: If an unprivileged user has write permissions to C:\ or C:\Program Files\, dropping a malicious executable named Program.exe or Enterprise.exe results in the SCM executing that binary with the service's privileges (typically SYSTEM) upon system reboot or service restart.
• Discovery Command:

  wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """"
  

2. Weak Service Permissions (DACL Misconfigurations)

Services in Windows are securable objects with Discretionary Access Control Lists (DACLs). If permissions on a service are overly permissive, unprivileged users can modify service parameters.

• Vulnerable Permissions: If standard groups (Authenticated Users, BUILTIN\Users, Everyone) possess SERVICE_CHANGE_CONFIG or SERVICE_ALL_ACCESS rights over a service.
• Exploitation: The tester reconfigures the service's binary path (binPath) to execute a command or payload, then stops and restarts the service:

  # Reconfigure the service binary path to execute a reverse shell or add a local admin
  sc config VulnerableService binPath= "net localgroup administrators attacker /add"
  sc stop VulnerableService
  sc start VulnerableService
  

• Verification Tool: Microsoft Sysinternals accesschk.exe -uwcqv "Authenticated Users" *

3. AlwaysInstallElevated Registry Setting

Windows Installer (msiexec.exe) allows administrative installations. Microsoft includes a policy setting intended for environments where non-administrators must install approved software.

• The Flaw: If the AlwaysInstallElevated registry key is set to 1 (DWORD) in BOTH of the following registry hives:
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated = 1
  • HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated = 1
• When both keys equal 1, the operating system executes all .msi installation packages with elevated NT AUTHORITY\SYSTEM privileges, regardless of the user's privilege level.
• Exploitation: The tester generates an MSI payload (e.g., via msfvenom -p windows/x64/shell_reverse_tcp ... -f msi -o update.msi) and executes it silently:

  msiexec /quiet /qn /i update.msi
  

4. Insecure Scheduled Tasks

Scheduled tasks running under high-privilege accounts (such as SYSTEM) that execute scripts (batch files, PowerShell) or binaries located in world-writable directories (e.g., C:\Temp\ or C:\ProgramData\). Replacing the script or binary elevates the attacker's context when the scheduled task fires.

---

Common Windows Services Security Assessment

1. Remote Desktop Protocol (RDP, TCP Port 3389)

• Protocol Architecture: Provides graphical desktop access over TCP port 3389 (and optional UDP 3389 for streaming optimization).
• Network Level Authentication (NLA):
  • Legacy RDP established the graphical session and loaded kernel drivers before prompting for user credentials, exposing the system to denial of service and pre-auth exploits like BlueKeep.
  • NLA Mechanics: Enforces client authentication via the Credential Security Support Provider (CredSSP) protocol using Kerberos or NTLM before the full RDP connection handshake occurs. Systems with NLA enabled silently drop unauthenticated exploit payloads targeting the RDP protocol stack.
• Session Hijacking via tscon.exe: An administrative user possessing SYSTEM privileges can hijack disconnected or locked interactive user sessions without entering the user's password using the built-in Terminal Services utility:

  # List active and disconnected user sessions
  query user
  # Hijack session ID 2 into the current console session
  tscon 2 /dest:console
  

2. Microsoft Internet Information Services (IIS, TCP Ports 80 / 443)

• Configuration Leakage (web.config): The central configuration file for ASP.NET applications hosted on IIS. Frequently contains database connection strings with embedded plaintext credentials, application API keys, and machine keys used for ViewState signing.
• Handler Mappings & ISAPI Filters: Handlers dictate how IIS processes specific file extensions (.asp, .aspx, .ashx). If an upload directory allows the upload of executable extensions and inherits script execution permissions, an attacker achieves web shell execution.
• IIS Short (8.3) Filename Disclosure: A legacy vulnerability where IIS reveals the first six characters of files and folders (e.g., SECRET~1.DOC) via tilde character enumeration due to Windows 8.3 filename compatibility in the NTFS driver.

3. Microsoft Exchange Server

• Architecture: Enterprise messaging platform deeply integrated with Active Directory. Key web endpoints include Outlook Web Access (/owa), Exchange ActiveSync (/Microsoft-Server-ActiveSync), Exchange Web Services (/ews), and the Exchange Administration Center (/ecp).
• Privilege Risks: Exchange servers belong to the high-privilege Exchange Windows Permissions and Exchange Trusted Subsystem Active Directory security groups, which historically possess WriteDacl permissions over domain objects, allowing an attacker who compromises Exchange to immediately escalate to Domain Admin.
• Pre-Auth Proxy Vulnerability Families:
  • ProxyLogon (CVE-2021-26855 / CVE-2021-27065): Pre-authentication Server-Side Request Forgery (SSRF) combined with an arbitrary file write flaw, allowing unauthenticated attackers to write web shells to the OWA directory.
  • ProxyShell (CVE-2021-34473 / CVE-2021-34523 / CVE-2021-31207): Pre-authentication path confusion, privilege elevation to SYSTEM via Exchange PowerShell backend, and arbitrary file write allowing remote command execution via exposed web ports.