Rough attempt at CVE-2020-1337 #14414
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Non-functional
|
Thanks for your pull request! Before this can be merged, we need the following documentation for your module: |
|
So this still is kind of hanging out while I get a better idea on why a specific-length comment is required inside the powershell script. |
length comment is required for the exploit to work.
|
Rather than do troubleshooting on the comment, I've replaced the |
There was a problem hiding this comment.
Thanks for this module @bwatters-r7 ! I successfully got a SYSTEM session on a unpatched genuine Windows 10 (build 10240). I left a few comments for you to review.
documentation/modules/exploit/windows/local/cve_2020_1337_printerdemon.md
Outdated
Show resolved
Hide resolved
documentation/modules/exploit/windows/local/cve_2020_1337_printerdemon.md
Outdated
Show resolved
Hide resolved
| return Exploit::CheckCode::Appears if sysinfo_value =~ /10/ && build_num <= 18363 | ||
|
|
||
| return Exploit::CheckCode::Safe | ||
| end |
There was a problem hiding this comment.
I'm wondering if this method should also check if it is actually a Windows before checking the build number?
| end | ||
|
|
||
| def validate_active_host | ||
| begin |
There was a problem hiding this comment.
Not a blocker, but you can skip begin ... end block when wrapping the entire method in a rescue clause:
def validate_active_host
print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}")
rescue Rex::Post::Meterpreter::RequestError => e
elog('Could not connect to session', error: e)
raise Msf::Exploit::Failed, 'Could not connect to session'
end
documentation/modules/exploit/windows/local/cve_2020_1337_printerdemon.md
Show resolved
Hide resolved
Removed unused method from ps script Cleaned up some code in the module Added removal instructions to the documentation
|
Thanks so much @cdelafuente-r7! I tried to make all the changes suggested and more. |
|
Thanks @bwatters-r7 for the updates. Everything looks good now. I tested against Windows 10 (build 10240) and got a SYSTEM session after reboot. I also verified the cleanup procedure works using the established session. Note that I couldn't find a target where the previous exploit (CVE-2020-1048) didn't work and, therefore, couldn't check if this exploit bypassed the first patch. I'll go ahead and land it. Output |
Release NotesNew module |
adfoster-r7
added
the
rn-modules
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Non-FunctionalI'm out for a few days and will get back to this when I can. I figured it is mostly done, so I'll chuck it up here as a placeholder if nothing else.The module works now. It still needs docs.I'm unsure about why, but this module failed when executing the powershell script unless I maintained a ~200 comment in it. My guess is that when that comment is gone, the powershell command method splits the script up differently in a way that breaks it.
At this point, I've just chucked in a random string of 197 characters because that makes it work(TM). If there's a way around that, I'm all for it.By moving to
execute_stringoverpsh_exec, there is no longer a need to the mystery comment.Verification Steps
exploit/windows/local/cve_2020_1048failsuse exploit/windows/local/cve_2020_1337_printerdemonset payload [payload]set [r|l]port nset session [n]set verbose true(optional)set DisablePayloadHandler Falseset wfsdelay 600runSample Run