Last updated at Mon, 24 Jul 2017 15:11:49 GMT
Weaponizing Local Exploits
This week's update features an exploit for Tavis @taviso Ormandy's vulnerability in the EPATHOBJ::pprFlattenRec function, which lives in win32k.sys on pretty much any Windows machine you're likely to run into. A whole lot of people threw in on this module to make this exploit reliable in Metasploit -- Tavis and progmboy wrote the original C exploit, new contributor @Keebie4e ported it to a Metasploit module, then a whole bunch of people threw in (and continue to do so) to make this exploit more and more stable. You can follow along at home by scrolling through PR #2036. I don't usually point at specific pull requests, but this one offers a pretty neat glimpse into how vulns become modules around here. If you're interested in exploit development, these are the kinds of discussions that are invaluable to follow along with.
Oh, and incidentally, there's no patch yet for this particular issue, so it's effectively 0-day. While it's "only" a privilege escalation, penetration testers pretty routinely need some way to elevate from a local user privilege level to local system (and from there, it's but a hop skip and jump away from Domain Administrator, thanks to the miracle of Mimikatz credential dumping.
Further, consider the power of an exploit like this when combine with, say, the latest Java Exploit from Adam Gowdiak and Matthias Kasier. What this means is that any malicious web server out on the Internet has a pretty straight shot at a whole lot of internal Windows networks.
That's pretty bad. Many, many domain administrators are now at the mercy of the next (secret, unpublished) client-side exploit. Hopefully, with the publication of this vulnerability, defenders (and Microsoft) will come up with a decent solution sooner rather than later. In the meantime, it seems like offensive security has the upper hand at the moment. Now might be a good time to check your defense in depth strategies...
New Modules
We've got five new modules this week, including the two referenced above. What can I say, the security community tends to get a little quiet in early July, as everyone finalizes their Bsides / BlackHat / DefCon material.
- SMTP Open Relay Detection by Campbell Murray
- Java Applet ProviderSkeleton Insecure Invoke Method by Adam Gowdiak and Matthias Kaiser exploits CVE-2013-2460
- Carberp Web Panel C2 Backdoor Remote PHP Code Execution by Steven K, bwall(Brian Wallace), and connection(Luis Santana)
- Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation by sinn3r, juan vazquez, egyp7, Keebie4e, Meatballs, Tavis Ormandy, and progmboy exploits CVE-2013-3660
- Windows Manage Trojanize Support Account by salcho
Availability
If you're new to Metasploit, you can get started by downloading Metasploit for Linux or Windows. If you're already tracking the bleeding-edge of Metasploit development, then these modules are but an msfupdate command away. For readers who prefer the packaged updates for Metasploit Community and Metasploit Pro, you'll be able to install the new hotness today when you check for updates through the Software Updates menu under Administration.
For additional details on what's changed and what's current, please see Brandont's most excellent release notes.
