[Dailydave] Exploit for NVidia nvvsvc.exe

[Peter WS]

Hi Darren!

Thanks, I am glad that you found it of interest! Your idea of running a
MOSDEF/Meterpreter shellcode should work fine and I expect you could
substitute the shellcode the exploit comes with for the appropriate staged
MOSDEF loader with little or no change. If the shellcode is greatly in
excess of 0x300 bytes (if memory serves me) you may need to put it into the
buffer formed by the BuildMalicious_OverwriteStack function rather than the
one formed by BuildMalicious_FillBuf, and jump back into it once the stack
is marked RWX, as there is limited stack space before we reach the top of
the stack.

Your approach would definitely avoid the need for psexec (or some other
technique), however since local admin <=> local system (but for a little
token work) I figured it would be good enough - seeing as how the exploit
was not ported to Canvas or Metasploit I figured this would be the nicest
way of providing the attacker with a shell (considering also that, in the
domain exploit context, the attacker would have to be able to access the
target over SMB anyway you can be pretty sure psexec will work consistently
too).

If you want to try the exploit out as is, please use the later version
(which unfortunately I had to pull for personal reasons, but which is
mirrored at
http://www.anonpaste.me/anonpaste2/index.php?7d9084b36b95d57e#LEVd4vMjqQlGzfip5uveBNezuKqIG3vulNwpOr5rUf4=)
as the Aug 2012 target seems to work for most of the laptops the exploit
has been tested on).

Do let me know if it bawks and you'd like me to take a look.

Thanks!
-Peter

On Tue, Dec 25, 2012 at 8:28 PM, Darren Martyn <darren at insecurety.net>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Peter,
> Interesting exploit, especially that it can be exploited remotely in
> that context!
>
> Now, my exploit writing skills are not great, but seeing as the code
> is executed in the context of a local service, could one not use
> shellcode such as a MOSDEF loader/stager or a Metasploit Meterpreter
> stager and gain remote access under the context of the local service
> (which, unless I am mistaken, runs with SYSTEM privs? Looking to test
> it later as I have a vuln laptop!). This would obiviate the need to
> (for remote exploitation) run psexec with the new creds.
> Or am I an idiot (who'se mind may be slowed down a little by the food
> and drink :3 )
>
> Best regards, and seasons greetings to all :)
>
> - - Darren Martyn
>
> On 25/12/12 16:36, Peter WS wrote:
> > Dear list,
> >
> > I've written an exploit for an interesting bug which I found a day
> > or so ago, and thought I'd share it with you.
> >
> > http://pastebin.com/QP7eZaJt
> >
> > Hope you enjoy! -Peter
> >
> >
> >
> >
> > _______________________________________________ Dailydave mailing
> > list Dailydave at lists.immunityinc.com
> > https://lists.immunityinc.com/mailman/listinfo/dailydave
>
>
> - --
> Insecurety Research - http://insecurety.net
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iQEcBAEBAgAGBQJQ2gxrAAoJEEqUSoN8D1ViDYMH/iXJwNBdCGhO8jnCG7pz/wYi
> HSXAJDS3NZBnb7B1mXj2X3XVVVq0IOHTXuJSPQHdYFGOnuC4fU9af8TbwuL8g0Uw
> ModJ5KYkVUgkLlD8yuQq5gj3amKm1DtNlDuzEiycQaArueO7dp4EnQ3QJKyoKSDm
> f5f/wmqLfUOX57cFEAaR4lE+tnttJ7S1yWtw741L1YIpywvZf/iK81ptuzho4j8s
> yyNFsR5pmxTgkoSYHktMMucSrBR3TufZ4kzSlWnZnirY3u67CbqNeHGq6NRt4NUq
> nZ/iMVUzCNWndD56IaRSVlNJBxbWZ4a8cxC8vuEcWdHJoHUY1r6Pr7S6Kf2geWY=
> =lEpb
> -----END PGP SIGNATURE-----
> _______________________________________________
> Dailydave mailing list
> Dailydave at lists.immunityinc.com
> https://lists.immunityinc.com/mailman/listinfo/dailydave
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.immunityinc.com/pipermail/dailydave/attachments/20130102/d971d996/attachment-0001.html>