CVE-2018-8440 PoC — Microsoft Windows 权限许可和访问控制问题漏洞

Source

https://github.com/sourceincite/CVE-2018-8440

Associated Vulnerability

Title:Microsoft Windows 权限许可和访问控制问题漏洞 (CVE-2018-8440)
Description:Microsoft Windows 10等都是美国微软（Microsoft）公司发布的一系列操作系统。Microsoft Windows 10是一套个人电脑使用的操作系统。Windows Server 2008 SP2是一套服务器操作系统。 Microsoft Windows中存在提权漏洞，该漏洞源于程序没有正确地处理高级本地过程调用（ALPC）调用。本地攻击者可通过登录系统并运行特制的应用程序利用该漏洞在本地系统的安全上下文中执行任意代码。以下系统版本受到影响：Microsoft Windows Ser

Description

CVE-2018-8440 standalone exploit

Readme

# CVE-2018-8440

Since I noticed that metasploit is using the [dll](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/alpc_taskscheduler.rb#L86) lib provided by SandboxEscaper and only has a target for [x64](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/alpc_taskscheduler.rb#L48), I decided to share my poc to the community. Of course there are much better vectors than targeting the print spooler, but I'll leave that as an exercise for the reader.

This is a standalone poc executable that was tested on x86 (I needed it for a client). AFAIK, this should also run on x64, but this environment as been untested at this time.

## Getting Started

* Run the Release poc.exe I dare you.

Just kidding.

### Prerequisites

* You might want to relink the resource file since `C:\Users\researcher\source\repos\lpe\Release\payload.dll` probably doesn't exist on your system.

### Installing

* Install Visual Studio 2017 (v141)
* Install Windows SDK 10.0.17134.0
* Relink the resource file in the poc project to a dll of choice
* Compile each project separately
* Run the built poc.exe

## Environment

This was tested on Windows 10 x86 Version 10.0.10240 with the latest patches at the time of development.

## Built With

* [Visual Studio 2017 (v141)](https://visualstudio.microsoft.com/downloads/) - IDE

## Authors

* **SandboxEscaper** - *Initial work* - [PoCLPE.rar](https://github.com/SandboxEscaper/randomrepo/blob/master/PoCLPE.rar)
* **mr_me** - this repo

## License

This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details

## Acknowledgments

* SandboxEscaper for the killer zeroday bug drop
* James Foreshaw for the CommonUtils project

File Snapshot


 [4.0K]  /data/pocs/c3547024df9a85102c3404398634242a77400792
├── [4.0K]  CommonUtils
│   ├── [3.7K]  CommonUtils.cpp
│   ├── [1.0K]  CommonUtils.h
│   ├── [4.9K]  CommonUtils.vcxproj
│   ├── [2.7K]  CommonUtils.vcxproj.filters
│   ├── [ 165]  CommonUtils.vcxproj.user
│   ├── [4.0K]  Debug
│   │   ├── [1.6K]  CommonUtils.Build.CppClean.log
│   │   ├── [635K]  CommonUtils.idb
│   │   ├── [  88]  CommonUtils.log
│   │   ├── [175K]  CommonUtils.obj
│   │   ├── [ 13M]  CommonUtils.pch
│   │   ├── [1.9M]  CommonUtils.pdb
│   │   ├── [4.0K]  CommonUtils.tlog
│   │   │   ├── [8.3K]  CL.command.1.tlog
│   │   │   ├── [144K]  CL.read.1.tlog
│   │   │   ├── [5.9K]  CL.write.1.tlog
│   │   │   ├── [ 212]  CommonUtils.lastbuildstate
│   │   │   ├── [2.0K]  Lib.command.1.tlog
│   │   │   ├── [3.0K]  Lib-link.read.1.tlog
│   │   │   └── [1.5K]  Lib-link.write.1.tlog
│   │   ├── [ 38K]  DirectoryObject.obj
│   │   ├── [ 60K]  FileOpLock.obj
│   │   ├── [233K]  FileSymlink.obj
│   │   ├── [157K]  Hardlink.obj
│   │   ├── [ 38K]  NativeSymlink.obj
│   │   ├── [168K]  RegistrySymlink.obj
│   │   ├── [397K]  ReparsePoint.obj
│   │   ├── [ 12K]  ScopedHandle.obj
│   │   └── [361K]  stdafx.obj
│   ├── [2.0K]  DirectoryObject.cpp
│   ├── [4.5K]  FileOpLock.cpp
│   ├── [ 789]  FileOpLock.h
│   ├── [5.0K]  FileSymlink.cpp
│   ├── [ 588]  FileSymlink.h
│   ├── [1.6K]  Hardlink.cpp
│   ├── [2.0K]  NativeSymlink.cpp
│   ├── [2.2K]  ntimports.h
│   ├── [5.2K]  RegistrySymlink.cpp
│   ├── [4.0K]  Release
│   │   ├── [1.5K]  CommonUtils.Build.CppClean.log
│   │   ├── [ 283]  CommonUtils.log
│   │   ├── [1.2M]  CommonUtils.obj
│   │   ├── [ 13M]  CommonUtils.pch
│   │   ├── [1.9M]  CommonUtils.pdb
│   │   ├── [4.0K]  CommonUtils.tlog
│   │   │   ├── [8.4K]  CL.command.1.tlog
│   │   │   ├── [144K]  CL.read.1.tlog
│   │   │   ├── [5.7K]  CL.write.1.tlog
│   │   │   ├── [ 214]  CommonUtils.lastbuildstate
│   │   │   ├── [2.1K]  Lib.command.1.tlog
│   │   │   ├── [3.0K]  Lib-link.read.1.tlog
│   │   │   └── [1.6K]  Lib-link.write.1.tlog
│   │   ├── [1.0M]  DirectoryObject.obj
│   │   ├── [1.0M]  FileOpLock.obj
│   │   ├── [1.2M]  FileSymlink.obj
│   │   ├── [1.1M]  Hardlink.obj
│   │   ├── [1.0M]  NativeSymlink.obj
│   │   ├── [1.2M]  RegistrySymlink.obj
│   │   ├── [1.1M]  ReparsePoint.obj
│   │   ├── [ 18K]  ScopedHandle.obj
│   │   └── [770K]  stdafx.obj
│   ├── [ 13K]  ReparsePoint.cpp
│   ├── [1.2K]  ReparsePoint.h
│   ├── [1.8K]  ScopedHandle.cpp
│   ├── [ 498]  ScopedHandle.h
│   ├── [ 298]  stdafx.cpp
│   ├── [ 270]  stdafx.h
│   ├── [ 314]  targetver.h
│   └── [1.3K]  typed_buffer.h
├── [2.7K]  CVE-2018-8440.sln
├── [4.0K]  Debug
│   ├── [1.7M]  CommonUtils.lib
│   ├── [1.9M]  CommonUtils.pdb
│   ├── [238K]  test.exe
│   ├── [693K]  test.ilk
│   └── [1.1M]  test.pdb
├── [1.0K]  LICENSE
├── [4.0K]  payload
│   ├── [ 529]  dllmain.cpp
│   ├── [ 212]  payload.cpp
│   ├── [8.2K]  payload.vcxproj
│   ├── [1.3K]  payload.vcxproj.filters
│   ├── [ 165]  payload.vcxproj.user
│   ├── [4.0K]  Release
│   │   ├── [923K]  dllmain.obj
│   │   ├── [1.1K]  payload.Build.CppClean.log
│   │   ├── [ 271]  payload.log
│   │   ├── [5.4K]  payload.obj
│   │   ├── [7.1M]  payload.pch
│   │   ├── [4.0K]  payload.tlog
│   │   │   ├── [2.7K]  CL.command.1.tlog
│   │   │   ├── [ 29K]  CL.read.1.tlog
│   │   │   ├── [1.6K]  CL.write.1.tlog
│   │   │   ├── [1.6K]  link.command.1.tlog
│   │   │   ├── [4.3K]  link.read.1.tlog
│   │   │   ├── [ 626]  link.write.1.tlog
│   │   │   ├── [ 214]  payload.lastbuildstate
│   │   │   └── [ 364]  payload.write.1u.tlog
│   │   ├── [326K]  stdafx.obj
│   │   └── [748K]  vc141.pdb
│   ├── [  44]  stdafx.cpp
│   ├── [ 826]  stdafx.h
│   └── [ 630]  targetver.h
├── [4.0K]  poc
│   ├── [4.0K]  Debug
│   │   ├── [3.4K]  pch.obj
│   │   ├── [ 42K]  rpc_c.obj
│   │   ├── [2.3K]  test.Build.CppClean.log
│   │   ├── [  86]  test.log
│   │   ├── [269K]  test.obj
│   │   ├── [1.9M]  test.pch
│   │   ├── [ 95K]  test.res
│   │   ├── [4.0K]  test.tlog
│   │   │   ├── [2.2K]  CL.command.1.tlog
│   │   │   ├── [ 61K]  CL.read.1.tlog
│   │   │   ├── [1.5K]  CL.write.1.tlog
│   │   │   ├── [1.8K]  link.command.1.tlog
│   │   │   ├── [4.4K]  link.read.1.tlog
│   │   │   ├── [ 898]  link.write.1.tlog
│   │   │   ├── [ 384]  midl.command.1.tlog
│   │   │   ├── [7.3K]  midl.read.1.tlog
│   │   │   ├── [ 412]  midl.write.1.tlog
│   │   │   ├── [ 336]  rc.command.1.tlog
│   │   │   ├── [2.7K]  rc.read.1.tlog
│   │   │   ├── [ 222]  rc.write.1.tlog
│   │   │   └── [ 212]  test.lastbuildstate
│   │   ├── [707K]  vc141.idb
│   │   └── [644K]  vc141.pdb
│   ├── [ 430]  pch.cpp
│   ├── [1.2K]  pch.h
│   ├── [ 10K]  poc.aps
│   ├── [ 10K]  poc.cpp
│   ├── [3.1K]  poc.rc
│   ├── [8.9K]  poc.vcxproj
│   ├── [1.7K]  poc.vcxproj.filters
│   ├── [ 165]  poc.vcxproj.user
│   ├── [4.0K]  Release
│   │   ├── [2.7K]  pch.obj
│   │   ├── [2.0K]  poc.Build.CppClean.log
│   │   ├── [2.1K]  poc.log
│   │   ├── [1.1M]  poc.obj
│   │   ├── [1.9M]  poc.pch
│   │   ├── [8.1K]  poc.res
│   │   ├── [4.0K]  poc.tlog
│   │   │   ├── [2.2K]  CL.command.1.tlog
│   │   │   ├── [ 61K]  CL.read.1.tlog
│   │   │   ├── [1.1K]  CL.write.1.tlog
│   │   │   ├── [1.9K]  link.command.1.tlog
│   │   │   ├── [4.9K]  link.read.1.tlog
│   │   │   ├── [ 804]  link.write.1.tlog
│   │   │   ├── [ 382]  midl.command.1.tlog
│   │   │   ├── [3.9K]  midl.read.1.tlog
│   │   │   ├── [ 404]  midl.write.1.tlog
│   │   │   ├── [ 214]  poc.lastbuildstate
│   │   │   ├── [ 332]  poc.write.1u.tlog
│   │   │   ├── [ 330]  rc.command.1.tlog
│   │   │   ├── [2.7K]  rc.read.1.tlog
│   │   │   └── [ 218]  rc.write.1.tlog
│   │   ├── [ 75K]  rpc_c.obj
│   │   ├── [1.7K]  test.Build.CppClean.log
│   │   ├── [2.1K]  test.log
│   │   ├── [4.0K]  test.tlog
│   │   │   ├── [2.2K]  CL.command.1.tlog
│   │   │   ├── [ 61K]  CL.read.1.tlog
│   │   │   ├── [1.1K]  CL.write.1.tlog
│   │   │   ├── [1.9K]  link.command.1.tlog
│   │   │   ├── [5.2K]  link.read.1.tlog
│   │   │   ├── [ 820]  link.write.1.tlog
│   │   │   ├── [ 388]  midl.command.1.tlog
│   │   │   ├── [3.9K]  midl.read.1.tlog
│   │   │   ├── [ 412]  midl.write.1.tlog
│   │   │   ├── [ 340]  rc.command.1.tlog
│   │   │   ├── [2.7K]  rc.read.1.tlog
│   │   │   ├── [ 226]  rc.write.1.tlog
│   │   │   ├── [ 214]  test.lastbuildstate
│   │   │   └── [1016]  test.write.1u.tlog
│   │   └── [604K]  vc141.pdb
│   ├── [ 447]  resource.h
│   ├── [ 59K]  rpc_c.c
│   ├── [7.0K]  rpc_h.h
│   ├── [4.9K]  rpc.idl
│   └── [ 51K]  rpc_s.c
├── [1.7K]  README.md
├── [4.0K]  Release
│   ├── [9.6M]  CommonUtils.lib
│   ├── [8.0K]  payload.dll
│   ├── [165K]  payload.iobj
│   ├── [2.2K]  payload.ipdb
│   ├── [1012K]  payload.pdb
│   ├── [ 40K]  poc.exe
│   ├── [599K]  poc.iobj
│   ├── [ 90K]  poc.ipdb
│   └── [2.4M]  poc.pdb
└── [4.0K]  Resource
    └── [8.0K]  payload.dll

17 directories, 179 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!