Metasploit Module: Cisco AnyConnect Privilege Escalations (CVE-2020-3153 and CVE-2020-3433)
Type: exploit
Path: modules/exploits/windows/local/anyconnect_lpe.rb
Platform: win
Disclosure date: 2020-08-05
References: URL-https://ssd-disclosure.com/ssd-advisory-cisco-anyconnect-privilege-elevation-through-path-traversal/, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj, CVE-2020-3153, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW, CVE-2020-3433
Targets: Windows x86/x64 with x86 payload

Description:
The installer component of Cisco AnyConnect Secure Mobility Client for Windows
          prior to 4.8.02042 is vulnerable to path traversal and allows local attackers
          to create/overwrite files in arbitrary locations with system level privileges.

          The installer component of Cisco AnyConnect Secure Mobility Client for Windows
          prior to 4.9.00086 is vulnerable to a DLL hijacking and allows local attackers
          to execute code on the affected machine with with system level privileges.

          Both attacks consist in sending a specially crafted IPC request to the TCP
          port 62522 on the loopback device, which is exposed by the Cisco AnyConnect
          Secure Mobility Agent service. This service will then launch the vulnerable
          installer component (`vpndownloader`), which copies itself to an arbitrary
          location (CVE-2020-3153) or with a supplied DLL (CVE-2020-3433) before being
          executed with system privileges. Since `vpndownloader` is also vulnerable to DLL
          hijacking, a specially crafted DLL (`dbghelp.dll`) is created at the same
          location `vpndownloader` will be copied to get code execution with system
          privileges.

          The CVE-2020-3153 exploit has been successfully tested against Cisco AnyConnect
          Secure Mobility Client versions 4.5.04029, 4.5.05030 and 4.7.04056 on Windows 10
          version 1909 (x64) and Windows 7 SP1 (x86); the CVE-2020-3434 exploit has been
          successfully tested against Cisco AnyConnect Secure Mobility Client versions
          4.5.02036, 4.6.03049, 4.7.04056, 4.8.01090 and 4.8.03052 on Windows 10 version
          1909 (x64) and 4.7.4056 on Windows 7 SP1 (x64).

Check method (fingerprinting):
install_path = sanitize_path(datastore['INSTALL_PATH'])
    if install_path&.!= ''
      vprint_status("Skipping installation path detection and use provided path: #{install_path}")
      @installation_path = file_exist?([install_path, 'vpndownloader.exe'].join('\\')) ? install_path : nil
    else
      vprint_status('Try to detect installation path...')
      @installation_path = detect_path
    end

    unless @installation_path
      return CheckCode.Safe('vpndownloader.exe not found on file system')
    end

    file_path = "#{@installation_path}\\vpndownloader.exe"
    vprint_status("Found vpndownloader.exe path: '#{file_path}'")

    version = file_version(file_path)
    unless version
      return CheckCode.Unknown('Unable to retrieve vpndownloader.exe file version')
    end

    cve_2020_3153 = (datastore['CVE'] == 'CVE-2020-3153')

    patched_version_cve_2020_3153 = Rex::Version.new('4.8.02042')
    patched_version_cve_2020_3433 = Rex::Version.new('4.9.00086')
    @ac_version = Rex::Version.new(version.join('.'))
    if @ac_version < patched_version_cve_2020_3153
      return CheckCode.Appears("Cisco AnyConnect version #{@ac_version} < #{patched_version_cve_2020_3153} (CVE-2020-3153 & CVE-2020-3433).")
    elsif (@ac_version < patched_version_cve_2020_3433) && !cve_2020_3153
      return CheckCode.Appears("Cisco AnyConnect version #{@ac_version} < #{patched_version_cve_2020_3433} (CVE-2020-3433).")
    elsif (@ac_version < patched_version_cve_2020_3433) && cve_2020_