Dailydave mailing list archives
Re: Exploit for NVidia nvvsvc.exe
From: Peter WS <peterwintrsmith () gmail com>
Date: Wed, 2 Jan 2013 20:15:31 +0000
Hi Darren! Thanks, I am glad that you found it of interest! Your idea of running a MOSDEF/Meterpreter shellcode should work fine and I expect you could substitute the shellcode the exploit comes with for the appropriate staged MOSDEF loader with little or no change. If the shellcode is greatly in excess of 0x300 bytes (if memory serves me) you may need to put it into the buffer formed by the BuildMalicious_OverwriteStack function rather than the one formed by BuildMalicious_FillBuf, and jump back into it once the stack is marked RWX, as there is limited stack space before we reach the top of the stack. Your approach would definitely avoid the need for psexec (or some other technique), however since local admin <=> local system (but for a little token work) I figured it would be good enough - seeing as how the exploit was not ported to Canvas or Metasploit I figured this would be the nicest way of providing the attacker with a shell (considering also that, in the domain exploit context, the attacker would have to be able to access the target over SMB anyway you can be pretty sure psexec will work consistently too). If you want to try the exploit out as is, please use the later version (which unfortunately I had to pull for personal reasons, but which is mirrored at http://www.anonpaste.me/anonpaste2/index.php?7d9084b36b95d57e#LEVd4vMjqQlGzfip5uveBNezuKqIG3vulNwpOr5rUf4=) as the Aug 2012 target seems to work for most of the laptops the exploit has been tested on). Do let me know if it bawks and you'd like me to take a look. Thanks! -Peter On Tue, Dec 25, 2012 at 8:28 PM, Darren Martyn <darren () insecurety net>wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Peter, Interesting exploit, especially that it can be exploited remotely in that context! Now, my exploit writing skills are not great, but seeing as the code is executed in the context of a local service, could one not use shellcode such as a MOSDEF loader/stager or a Metasploit Meterpreter stager and gain remote access under the context of the local service (which, unless I am mistaken, runs with SYSTEM privs? Looking to test it later as I have a vuln laptop!). This would obiviate the need to (for remote exploitation) run psexec with the new creds. Or am I an idiot (who'se mind may be slowed down a little by the food and drink :3 ) Best regards, and seasons greetings to all :) - - Darren Martyn On 25/12/12 16:36, Peter WS wrote:Dear list, I've written an exploit for an interesting bug which I found a day or so ago, and thought I'd share it with you. http://pastebin.com/QP7eZaJt Hope you enjoy! -Peter _______________________________________________ Dailydave mailing list Dailydave () lists immunityinc com https://lists.immunityinc.com/mailman/listinfo/dailydave- -- Insecurety Research - http://insecurety.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJQ2gxrAAoJEEqUSoN8D1ViDYMH/iXJwNBdCGhO8jnCG7pz/wYi HSXAJDS3NZBnb7B1mXj2X3XVVVq0IOHTXuJSPQHdYFGOnuC4fU9af8TbwuL8g0Uw ModJ5KYkVUgkLlD8yuQq5gj3amKm1DtNlDuzEiycQaArueO7dp4EnQ3QJKyoKSDm f5f/wmqLfUOX57cFEAaR4lE+tnttJ7S1yWtw741L1YIpywvZf/iK81ptuzho4j8s yyNFsR5pmxTgkoSYHktMMucSrBR3TufZ4kzSlWnZnirY3u67CbqNeHGq6NRt4NUq nZ/iMVUzCNWndD56IaRSVlNJBxbWZ4a8cxC8vuEcWdHJoHUY1r6Pr7S6Kf2geWY= =lEpb -----END PGP SIGNATURE----- _______________________________________________ Dailydave mailing list Dailydave () lists immunityinc com https://lists.immunityinc.com/mailman/listinfo/dailydave
_______________________________________________ Dailydave mailing list Dailydave () lists immunityinc com https://lists.immunityinc.com/mailman/listinfo/dailydave
Current thread:
- Re: Exploit for NVidia nvvsvc.exe Darren Martyn (Jan 02)
- Re: Exploit for NVidia nvvsvc.exe Peter WS (Jan 02)