CVE-2018-8440 PoC — Microsoft Windows 权限许可和访问控制问题漏洞

Source

https://github.com/sourceincite/CVE-2018-8440

Associated Vulnerability

Title:Microsoft Windows 权限许可和访问控制问题漏洞 (CVE-2018-8440)
Description:An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Description

CVE-2018-8440 standalone exploit

Readme

# CVE-2018-8440

Since I noticed that metasploit is using the [dll](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/alpc_taskscheduler.rb#L86) lib provided by SandboxEscaper and only has a target for [x64](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/alpc_taskscheduler.rb#L48), I decided to share my poc to the community. Of course there are much better vectors than targeting the print spooler, but I'll leave that as an exercise for the reader.

This is a standalone poc executable that was tested on x86 (I needed it for a client). AFAIK, this should also run on x64, but this environment as been untested at this time.

## Getting Started

* Run the Release poc.exe I dare you.

Just kidding.

### Prerequisites

* You might want to relink the resource file since `C:\Users\researcher\source\repos\lpe\Release\payload.dll` probably doesn't exist on your system.

### Installing

* Install Visual Studio 2017 (v141)
* Install Windows SDK 10.0.17134.0
* Relink the resource file in the poc project to a dll of choice
* Compile each project separately
* Run the built poc.exe

## Environment

This was tested on Windows 10 x86 Version 10.0.10240 with the latest patches at the time of development.

## Built With

* [Visual Studio 2017 (v141)](https://visualstudio.microsoft.com/downloads/) - IDE

## Authors

* **SandboxEscaper** - *Initial work* - [PoCLPE.rar](https://github.com/SandboxEscaper/randomrepo/blob/master/PoCLPE.rar)
* **mr_me** - this repo

## License

This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details

## Acknowledgments

* SandboxEscaper for the killer zeroday bug drop
* James Foreshaw for the CommonUtils project

File Snapshot


 [4.0K]  /data/pocs/c3547024df9a85102c3404398634242a77400792
├── [4.0K]  CommonUtils
│   ├── [3.7K]  CommonUtils.cpp
│   ├── [1.0K]  CommonUtils.h
│   ├── [4.9K]  CommonUtils.vcxproj
│   ├── [2.7K]  CommonUtils.vcxproj.filters
│   ├── [ 165]  CommonUtils.vcxproj.user
│   ├── [4.0K]  Debug
│   │   ├── [1.6K]  CommonUtils.Build.CppClean.log
│   │   ├── [635K]  CommonUtils.idb
│   │   ├── [  88]  CommonUtils.log
│   │   ├── [175K]  CommonUtils.obj
│   │   ├── [ 13M]  CommonUtils.pch
│   │   ├── [1.9M]  CommonUtils.pdb
│   │   ├── [4.0K]  CommonUtils.tlog
│   │   │   ├── [8.3K]  CL.command.1.tlog
│   │   │   ├── [144K]  CL.read.1.tlog
│   │   │   ├── [5.9K]  CL.write.1.tlog
│   │   │   ├── [ 212]  CommonUtils.lastbuildstate
│   │   │   ├── [2.0K]  Lib.command.1.tlog
│   │   │   ├── [3.0K]  Lib-link.read.1.tlog
│   │   │   └── [1.5K]  Lib-link.write.1.tlog
│   │   ├── [ 38K]  DirectoryObject.obj
│   │   ├── [ 60K]  FileOpLock.obj
│   │   ├── [233K]  FileSymlink.obj
│   │   ├── [157K]  Hardlink.obj
│   │   ├── [ 38K]  NativeSymlink.obj
│   │   ├── [168K]  RegistrySymlink.obj
│   │   ├── [397K]  ReparsePoint.obj
│   │   ├── [ 12K]  ScopedHandle.obj
│   │   └── [361K]  stdafx.obj
│   ├── [2.0K]  DirectoryObject.cpp
│   ├── [4.5K]  FileOpLock.cpp
│   ├── [ 789]  FileOpLock.h
│   ├── [5.0K]  FileSymlink.cpp
│   ├── [ 588]  FileSymlink.h
│   ├── [1.6K]  Hardlink.cpp
│   ├── [2.0K]  NativeSymlink.cpp
│   ├── [2.2K]  ntimports.h
│   ├── [5.2K]  RegistrySymlink.cpp
│   ├── [4.0K]  Release
│   │   ├── [1.5K]  CommonUtils.Build.CppClean.log
│   │   ├── [ 283]  CommonUtils.log
│   │   ├── [1.2M]  CommonUtils.obj
│   │   ├── [ 13M]  CommonUtils.pch
│   │   ├── [1.9M]  CommonUtils.pdb
│   │   ├── [4.0K]  CommonUtils.tlog
│   │   │   ├── [8.4K]  CL.command.1.tlog
│   │   │   ├── [144K]  CL.read.1.tlog
│   │   │   ├── [5.7K]  CL.write.1.tlog
│   │   │   ├── [ 214]  CommonUtils.lastbuildstate
│   │   │   ├── [2.1K]  Lib.command.1.tlog
│   │   │   ├── [3.0K]  Lib-link.read.1.tlog
│   │   │   └── [1.6K]  Lib-link.write.1.tlog
│   │   ├── [1.0M]  DirectoryObject.obj
│   │   ├── [1.0M]  FileOpLock.obj
│   │   ├── [1.2M]  FileSymlink.obj
│   │   ├── [1.1M]  Hardlink.obj
│   │   ├── [1.0M]  NativeSymlink.obj
│   │   ├── [1.2M]  RegistrySymlink.obj
│   │   ├── [1.1M]  ReparsePoint.obj
│   │   ├── [ 18K]  ScopedHandle.obj
│   │   └── [770K]  stdafx.obj
│   ├── [ 13K]  ReparsePoint.cpp
│   ├── [1.2K]  ReparsePoint.h
│   ├── [1.8K]  ScopedHandle.cpp
│   ├── [ 498]  ScopedHandle.h
│   ├── [ 298]  stdafx.cpp
│   ├── [ 270]  stdafx.h
│   ├── [ 314]  targetver.h
│   └── [1.3K]  typed_buffer.h
├── [2.7K]  CVE-2018-8440.sln
├── [4.0K]  Debug
│   ├── [1.7M]  CommonUtils.lib
│   ├── [1.9M]  CommonUtils.pdb
│   ├── [238K]  test.exe
│   ├── [693K]  test.ilk
│   └── [1.1M]  test.pdb
├── [1.0K]  LICENSE
├── [4.0K]  payload
│   ├── [ 529]  dllmain.cpp
│   ├── [ 212]  payload.cpp
│   ├── [8.2K]  payload.vcxproj
│   ├── [1.3K]  payload.vcxproj.filters
│   ├── [ 165]  payload.vcxproj.user
│   ├── [4.0K]  Release
│   │   ├── [923K]  dllmain.obj
│   │   ├── [1.1K]  payload.Build.CppClean.log
│   │   ├── [ 271]  payload.log
│   │   ├── [5.4K]  payload.obj
│   │   ├── [7.1M]  payload.pch
│   │   ├── [4.0K]  payload.tlog
│   │   │   ├── [2.7K]  CL.command.1.tlog
│   │   │   ├── [ 29K]  CL.read.1.tlog
│   │   │   ├── [1.6K]  CL.write.1.tlog
│   │   │   ├── [1.6K]  link.command.1.tlog
│   │   │   ├── [4.3K]  link.read.1.tlog
│   │   │   ├── [ 626]  link.write.1.tlog
│   │   │   ├── [ 214]  payload.lastbuildstate
│   │   │   └── [ 364]  payload.write.1u.tlog
│   │   ├── [326K]  stdafx.obj
│   │   └── [748K]  vc141.pdb
│   ├── [  44]  stdafx.cpp
│   ├── [ 826]  stdafx.h
│   └── [ 630]  targetver.h
├── [4.0K]  poc
│   ├── [4.0K]  Debug
│   │   ├── [3.4K]  pch.obj
│   │   ├── [ 42K]  rpc_c.obj
│   │   ├── [2.3K]  test.Build.CppClean.log
│   │   ├── [  86]  test.log
│   │   ├── [269K]  test.obj
│   │   ├── [1.9M]  test.pch
│   │   ├── [ 95K]  test.res
│   │   ├── [4.0K]  test.tlog
│   │   │   ├── [2.2K]  CL.command.1.tlog
│   │   │   ├── [ 61K]  CL.read.1.tlog
│   │   │   ├── [1.5K]  CL.write.1.tlog
│   │   │   ├── [1.8K]  link.command.1.tlog
│   │   │   ├── [4.4K]  link.read.1.tlog
│   │   │   ├── [ 898]  link.write.1.tlog
│   │   │   ├── [ 384]  midl.command.1.tlog
│   │   │   ├── [7.3K]  midl.read.1.tlog
│   │   │   ├── [ 412]  midl.write.1.tlog
│   │   │   ├── [ 336]  rc.command.1.tlog
│   │   │   ├── [2.7K]  rc.read.1.tlog
│   │   │   ├── [ 222]  rc.write.1.tlog
│   │   │   └── [ 212]  test.lastbuildstate
│   │   ├── [707K]  vc141.idb
│   │   └── [644K]  vc141.pdb
│   ├── [ 430]  pch.cpp
│   ├── [1.2K]  pch.h
│   ├── [ 10K]  poc.aps
│   ├── [ 10K]  poc.cpp
│   ├── [3.1K]  poc.rc
│   ├── [8.9K]  poc.vcxproj
│   ├── [1.7K]  poc.vcxproj.filters
│   ├── [ 165]  poc.vcxproj.user
│   ├── [4.0K]  Release
│   │   ├── [2.7K]  pch.obj
│   │   ├── [2.0K]  poc.Build.CppClean.log
│   │   ├── [2.1K]  poc.log
│   │   ├── [1.1M]  poc.obj
│   │   ├── [1.9M]  poc.pch
│   │   ├── [8.1K]  poc.res
│   │   ├── [4.0K]  poc.tlog
│   │   │   ├── [2.2K]  CL.command.1.tlog
│   │   │   ├── [ 61K]  CL.read.1.tlog
│   │   │   ├── [1.1K]  CL.write.1.tlog
│   │   │   ├── [1.9K]  link.command.1.tlog
│   │   │   ├── [4.9K]  link.read.1.tlog
│   │   │   ├── [ 804]  link.write.1.tlog
│   │   │   ├── [ 382]  midl.command.1.tlog
│   │   │   ├── [3.9K]  midl.read.1.tlog
│   │   │   ├── [ 404]  midl.write.1.tlog
│   │   │   ├── [ 214]  poc.lastbuildstate
│   │   │   ├── [ 332]  poc.write.1u.tlog
│   │   │   ├── [ 330]  rc.command.1.tlog
│   │   │   ├── [2.7K]  rc.read.1.tlog
│   │   │   └── [ 218]  rc.write.1.tlog
│   │   ├── [ 75K]  rpc_c.obj
│   │   ├── [1.7K]  test.Build.CppClean.log
│   │   ├── [2.1K]  test.log
│   │   ├── [4.0K]  test.tlog
│   │   │   ├── [2.2K]  CL.command.1.tlog
│   │   │   ├── [ 61K]  CL.read.1.tlog
│   │   │   ├── [1.1K]  CL.write.1.tlog
│   │   │   ├── [1.9K]  link.command.1.tlog
│   │   │   ├── [5.2K]  link.read.1.tlog
│   │   │   ├── [ 820]  link.write.1.tlog
│   │   │   ├── [ 388]  midl.command.1.tlog
│   │   │   ├── [3.9K]  midl.read.1.tlog
│   │   │   ├── [ 412]  midl.write.1.tlog
│   │   │   ├── [ 340]  rc.command.1.tlog
│   │   │   ├── [2.7K]  rc.read.1.tlog
│   │   │   ├── [ 226]  rc.write.1.tlog
│   │   │   ├── [ 214]  test.lastbuildstate
│   │   │   └── [1016]  test.write.1u.tlog
│   │   └── [604K]  vc141.pdb
│   ├── [ 447]  resource.h
│   ├── [ 59K]  rpc_c.c
│   ├── [7.0K]  rpc_h.h
│   ├── [4.9K]  rpc.idl
│   └── [ 51K]  rpc_s.c
├── [1.7K]  README.md
├── [4.0K]  Release
│   ├── [9.6M]  CommonUtils.lib
│   ├── [8.0K]  payload.dll
│   ├── [165K]  payload.iobj
│   ├── [2.2K]  payload.ipdb
│   ├── [1012K]  payload.pdb
│   ├── [ 40K]  poc.exe
│   ├── [599K]  poc.iobj
│   ├── [ 90K]  poc.ipdb
│   └── [2.4M]  poc.pdb
└── [4.0K]  Resource
    └── [8.0K]  payload.dll

17 directories, 179 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!