# Windows Installer, Exploiting Custom Actions

Windows Installer repair runs elevated custom actions using user-controllable environment variables, letting a low-privileged user execute arbitrary code as SYSTEM.

- Payout: Research
- Severity: high
- Program: Windows Installer
- Credited: Doyensec
- Disclosed: 2024-07-17
- Write-up quality: 8/10
- Original: https://blog.doyensec.com/2024/07/18/custom-actions.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2024-07-18-custom-actions-html
- Tags: domain:desktop impact:privesc kind:research platform:research sev:high tech:windows technique:source-review vuln:command-injection vuln:privilege-escalation

**Target:** Windows Installer (msiexec) custom actions
**Root cause:** Elevated custom actions (Impersonate="no", deferred/commit/rollback) expand environment variables like USERPROFILE from the invoking user's context, allowing a standard user to control the executable path.
**Steps:**
1. Create an MSI with a custom action that sets a property to `[%USERPROFILE]\test.exe` and a deferred/commit action with `Impersonate="no"` that executes it via WixQuietExec64.
2. Install the MSI as an administrator.
3. As a low-privileged user, place a malicious `test.exe` in `C:\Users\lowpriv\`.
4. Trigger repair: `msiexec /fa {12345678-9259-4E29-91EA-8F8646930000}`.
5. The custom action runs `test.exe` with SYSTEM integrity, executing the payload.
**How found:** After previous research on MSI repair impersonation issues, the author explored custom actions and noticed that environment variables like USERPROFILE are expanded from the invoking user's context even when the action runs elevated.
**Exploitation:** A low-privileged user plants a malicious executable in their own profile directory and triggers an MSI repair. The elevated custom action expands `[%USERPROFILE]` to the low-priv user's path and executes the payload as SYSTEM, yielding privilege escalation.
**Insight:** When auditing installers, look for elevated custom actions that use environment variables or installer properties (e.g., USERPROFILE, TEMP) to construct paths or commands; these can be poisoned by a standard user triggering a repair.