Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

Question

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows Server 2000 and Windows Server 2008.

In the same fashion is privilege escalation possible with Windows Server 2012? Please let me know the vulnerability reported on the same line is possible with CreateNamedPipe method and Impersonation - bulletin: Microsoft Security Bulletin MS15-050 - Important.

If the vulnerability mentioned in above bulletin does not work with CreateNamedPipe, then is there other vulnerability which causes privilege escalation after use of CreateNamedPipe method? Why I am asking this question is because in the Microsoft's blog they mentioned the patch for related vulnerability only but never confirmed that whether same patch will be applicable to other flavors of Windows developed afterwards.

Answer 1

MS15-050 (CVE-2015-1702) and other vulnerabilities against tokens on the Windows Server 2012 platform do not appear to leverage the CreateNamedPipe method.

You can see a binary diff and vulnerability analysis of CVE-2015-1702 by Alex Ionescu in his blog entitled, Analyzing MS15-050 With Diaphora. There is also a Nessus plugin to test for the existence of MS15-050 available -- here -- but the scanner likely only checks the patch level.

You could always get the exploit code for CVE-2010-2554 (but not CVE-2010-2555, the other half of MS10-059) via Exploit-DB, CORE IMPACT, or CANVAS and then compare that code to Alex Ionescu's analysis, or the further work done on similar token impersonation privilege-escalation bugs by Google Project Zero (such as their work on CVE-2015-0002 that led to the development of the popular metasploit-framework exploit/windows/local/ntapphelpcachecontrol module). P0 even produced a nice set of tools to check for these sorts of things in sandboxes.