CreateThread interception, to use CreateRemoteThread

sandbox/win/src/process_thread_policy.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/src/process_thread_policy.h"
 
 #include <stdint.h>
 
 #include <string>
 
@@ skipping 81 matching lines @@
       return false;
     };
   }
 
   if (!process->AddStringMatch(IF, NameBased::NAME, name, CASE_INSENSITIVE)) {
     return false;
   }
   if (!policy->AddRule(IPC_CREATEPROCESSW_TAG, process.get())) {
     return false;
   }
+  if (!policy->AddRule(IPC_CREATETHREAD_TAG, process.get())) {
+    return false;
+  }
   return true;
 }
 
 NTSTATUS ProcessPolicy::OpenThreadAction(const ClientInfo& client_info,
                                          uint32_t desired_access,
                                          uint32_t thread_id,
                                          HANDLE* handle) {
   *handle = NULL;
 
   NtOpenThreadFunction NtOpenThread = NULL;
@@ skipping 119 matching lines @@
   BOOL should_give_full_access = (GIVE_ALLACCESS == eval_result);
   if (!CreateProcessExWHelper(client_info.process, should_give_full_access,
                               app_name.c_str(), cmd_line.get(), NULL, NULL,
                               FALSE, 0, NULL, NULL, &startup_info,
                               process_info)) {
     return ERROR_ACCESS_DENIED;
   }
   return ERROR_SUCCESS;
 }
 
+DWORD ProcessPolicy::CreateThreadAction(
+    EvalResult eval_result,
+    const ClientInfo& client_info,
+    const SIZE_T stack_size,
+    const LPTHREAD_START_ROUTINE start_address,
+    const LPVOID parameter,
+    const DWORD creation_flags,
+    LPDWORD thread_id,
+    HANDLE* handle) {
+  // The only action supported is ASK_BROKER which means create the thread.
+  if (GIVE_ALLACCESS != eval_result && GIVE_READONLY != eval_result) {
+    return ERROR_ACCESS_DENIED;
+  }
+  HANDLE local_handle =
+      CreateRemoteThread(client_info.process, nullptr, stack_size,

[cpu_(ooo_6.6-7.5), 2016/02/04 01:40:52]

hmm, what if I pass -1 in client_info.process

?!?

[jschuh, 2016/02/04 04:49:51]

Uh... You're just messing with him here, yes?

[liamjm (20p), 2016/02/04 21:56:38]

As far as I can tell, a user can't control this, it is supplied as part of the
IPC mechanism

+                         start_address, parameter, creation_flags, thread_id);

[cpu_(ooo_6.6-7.5), 2016/02/04 01:40:52]

use :: for windows API calls

[liamjm (20p), 2016/02/04 21:56:38]

Done.

+  if (!local_handle) {
+    return ::GetLastError();
+  }
+  if (!::DuplicateHandle(::GetCurrentProcess(), local_handle,
+                         client_info.process, handle, 0, FALSE,
+                         DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS)) {
+    return ERROR_ACCESS_DENIED;
+  }
+  return ERROR_SUCCESS;
+}
+
 }  // namespace sandbox