Skip to content

Commit 176e88f

Browse files
author
Brent Cook
committed
Land rapid7#7835, Add Windows Local Privilege Escalation exploit stub
2 parents e18eb98 + b6e882c commit 176e88f

File tree

8 files changed

+461
-9
lines changed

8 files changed

+461
-9
lines changed

‎external/source/exploits/capcom_sys_exec/capcom_sys_exec/capcom_sys_exec.c

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,7 @@
33
#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
44
#include "kernel.h"
55

6-
DWORD WINAPI execute_payload(LPVOID lpPayload)
7-
{
8-
VOID(*lpCode)() = (VOID(*)())lpPayload;
9-
lpCode();
10-
return ERROR_SUCCESS;
11-
}
12-
13-
DWORD WINAPI capcom_sys_exec(LPVOID lpPayload)
6+
DWORD capcom_sys_exec(LPVOID lpPayload)
147
{
158
const DWORD PwnControlCode = 0xAA013044;
169
HANDLE driver = INVALID_HANDLE_VALUE;

‎external/source/exploits/windows-lpe-template/.gitignore

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
## Ignore Visual Studio temporary files, build results, and
2+
## files generated by popular Visual Studio add-ons.
3+
4+
# User-specific files
5+
*.suo
6+
*.user
7+
*.sln.docstates
8+
9+
# Build results
10+
11+
[Dd]ebug/
12+
[Rr]elease/
13+
x64/
14+
build/
15+
[Bb]in/
16+
[Oo]bj/
17+
18+
# Enable "build/" folder in the NuGet Packages folder since NuGet packages use it for MSBuild targets
19+
!packages/*/build/
20+
21+
# MSTest test Results
22+
[Tt]est[Rr]esult*/
23+
[Bb]uild[Ll]og.*
24+
25+
*_i.c
26+
*_p.c
27+
*.ilk
28+
*.meta
29+
*.obj
30+
*.pch
31+
*.pdb
32+
*.pgc
33+
*.pgd
34+
*.rsp
35+
*.sbr
36+
*.tlb
37+
*.tli
38+
*.tlh
39+
*.tmp
40+
*.tmp_proj
41+
*.log
42+
*.vspscc
43+
*.vssscc
44+
.builds
45+
*.pidb
46+
*.log
47+
*.scc
48+
49+
# Visual C++ cache files
50+
ipch/
51+
*.aps
52+
*.ncb
53+
*.opensdf
54+
*.sdf
55+
*.cachefile
56+
57+
# Visual Studio profiler
58+
*.psess
59+
*.vsp
60+
*.vspx
61+
62+
# Guidance Automation Toolkit
63+
*.gpState
64+
65+
# ReSharper is a .NET coding add-in
66+
_ReSharper*/
67+
*.[Rr]e[Ss]harper
68+
69+
# TeamCity is a build add-in
70+
_TeamCity*
71+
72+
# DotCover is a Code Coverage Tool
73+
*.dotCover
74+
75+
# NCrunch
76+
*.ncrunch*
77+
.*crunch*.local.xml
78+
79+
# Installshield output folder
80+
[Ee]xpress/
81+
82+
# DocProject is a documentation generator add-in
83+
DocProject/buildhelp/
84+
DocProject/Help/*.HxT
85+
DocProject/Help/*.HxC
86+
DocProject/Help/*.hhc
87+
DocProject/Help/*.hhk
88+
DocProject/Help/*.hhp
89+
DocProject/Help/Html2
90+
DocProject/Help/html
91+
92+
# Click-Once directory
93+
publish/
94+
95+
# Publish Web Output
96+
*.Publish.xml
97+
*.pubxml
98+
99+
# NuGet Packages Directory
100+
## TODO: If you have NuGet Package Restore enabled, uncomment the next line
101+
#packages/
102+
103+
# Windows Azure Build Output
104+
csx
105+
*.build.csdef
106+
107+
# Windows Store app package directory
108+
AppPackages/
109+
110+
# Others
111+
sql/
112+
*.Cache
113+
ClientBin/
114+
[Ss]tyle[Cc]op.*
115+
~$*
116+
*~
117+
*.dbmdl
118+
*.[Pp]ublish.xml
119+
*.pfx
120+
*.publishsettings
121+
122+
# RIA/Silverlight projects
123+
Generated_Code/
124+
125+
# Backup & report files from converting an old project file to a newer
126+
# Visual Studio version. Backup files are not needed, because we have git ;-)
127+
_UpgradeReport_Files/
128+
Backup*/
129+
UpgradeLog*.XML
130+
UpgradeLog*.htm
131+
132+
# SQL Server files
133+
App_Data/*.mdf
134+
App_Data/*.ldf
135+
136+
# =========================
137+
# Windows detritus
138+
# =========================
139+
140+
# Windows image file caches
141+
Thumbs.db
142+
ehthumbs.db
143+
144+
# Folder config file
145+
Desktop.ini
146+
147+
# Recycle Bin used on file shares
148+
$RECYCLE.BIN/
149+
150+
# Mac crap
151+
.DS_Store

‎external/source/exploits/windows-lpe-template/make.msbuild

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" standalone="yes"?>
2+
<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<PropertyGroup>
4+
<SolutionPath>.\windows-lpe-template.sln</SolutionPath>
5+
</PropertyGroup>
6+
7+
<Target Name="all" DependsOnTargets="x86;x64" />
8+
9+
<Target Name="x86">
10+
<Message Text="Building windows-lpe-template x86 Release version" />
11+
<MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=win32" Targets="Clean;Rebuild"/>
12+
</Target>
13+
14+
<Target Name="x64">
15+
<Message Text="Building windows-lpe-template x64 Release version" />
16+
<MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=x64" Targets="Clean;Rebuild"/>
17+
</Target>
18+
</Project>

‎external/source/exploits/windows-lpe-template/windows-lpe-template.sln

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 2013
4+
VisualStudioVersion = 12.0.40629.0
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "windows-lpe-template", "windows-lpe-template\windows-lpe-template.vcxproj", "{A67BA207-7AAC-4850-BEB1-E7FA07BAC0B1}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Release|Win32 = Release|Win32
11+
Release|x64 = Release|x64
12+
EndGlobalSection
13+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14+
{A67BA207-7AAC-4850-BEB1-E7FA07BAC0B1}.Release|Win32.ActiveCfg = Release|Win32
15+
{A67BA207-7AAC-4850-BEB1-E7FA07BAC0B1}.Release|Win32.Build.0 = Release|Win32
16+
{A67BA207-7AAC-4850-BEB1-E7FA07BAC0B1}.Release|x64.ActiveCfg = Release|x64
17+
{A67BA207-7AAC-4850-BEB1-E7FA07BAC0B1}.Release|x64.Build.0 = Release|x64
18+
EndGlobalSection
19+
GlobalSection(SolutionProperties) = preSolution
20+
HideSolutionNode = FALSE
21+
EndGlobalSection
22+
EndGlobal

‎external/source/exploits/windows-lpe-template/windows-lpe-template/exploit.c

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
// Make sure you leave these defines and includes alone.
2+
#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
3+
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
4+
#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
5+
#include "kernel.h"
6+
7+
// Add your own defines/includes here.
8+
9+
DWORD WINAPI run_exploit(LPVOID lpPayload)
10+
{
11+
// Put your required local variables here
12+
//LPVOID thing = malloc(100);
13+
14+
do
15+
{
16+
// all of your exploit stuff goes here
17+
18+
// Do some work, check for error, if fails, break.
19+
// TODO: remove this if not needed, otherwise modify
20+
// to run your own code.
21+
//if (FALSE)
22+
//{
23+
// break;
24+
//}
25+
26+
// prepare for kernel exploitation after the initial work has been done.
27+
// This allows for other helper functions to run inside the kernel. If
28+
// you forget to do this bit, then things in kernel land will crash!
29+
if (!prepare_for_kernel())
30+
{
31+
break;
32+
}
33+
34+
// This is where the exploit should be run from. When executing your exploit,
35+
// make sure that the `steal_process_token()` function from kernel.h is executed
36+
// inside the kernel (and preferrably nothing more!). This will conduct the token stealing
37+
// under the context of the kernel.
38+
39+
// Check to see if things worked, and that we have a payload
40+
if (was_token_replaced() && lpPayload)
41+
{
42+
// If so, just go ahead and execute the payload that MSF sent us.
43+
execute_payload(lpPayload);
44+
}
45+
46+
} while (0);
47+
48+
// Free up your stuff here.
49+
//if (thing != NULL)
50+
//{
51+
// free(thing);
52+
//}
53+
54+
return 0;
55+
}
56+
57+
////////////////////////////////////////////////////////////////////////////////////////////////////
58+
//
59+
// There shouldn't be any need to modify anything below this line.
60+
//
61+
////////////////////////////////////////////////////////////////////////////////////////////////////
62+
63+
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
64+
{
65+
BOOL bReturnValue = TRUE;
66+
switch (dwReason)
67+
{
68+
case DLL_QUERY_HMODULE:
69+
hAppInstance = hinstDLL;
70+
if (lpReserved != NULL)
71+
{
72+
*(HMODULE *)lpReserved = hAppInstance;
73+
}
74+
break;
75+
case DLL_PROCESS_ATTACH:
76+
hAppInstance = hinstDLL;
77+
// lpReserved should have been passed in by MSF and points
78+
// to the shellcode/payload that is to be executed if the
79+
// exploit actually succeeds.
80+
run_exploit(lpReserved);
81+
break;
82+
case DLL_PROCESS_DETACH:
83+
case DLL_THREAD_ATTACH:
84+
case DLL_THREAD_DETACH:
85+
break;
86+
}
87+
return bReturnValue;
88+
}

0 commit comments

Comments
 (0)