According to Microsoft, “The vulnerability could allow remote code execution if Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.” Below is the setup I used to write this article.
Virtualbox Kali Linux running inside the virtualbox Windows 7 machine running inside the virtualbox
Kali and Windows 7 are connected with “Host Only Adapter.”
To test the vulnerability, just open up Notepad on your Windows machine and enter the following:
Figure: file created with the name “calc.mcl” For those lazy bugs, a Python script has been made available on exploit-db, to create this POC file just by running the script. Here are the details: The Python script is available at the following link. https://www.exploit-db.com/exploits/38151/ We can run this script to generate the Music.mcl file. It contains the same file content that we typed in the notepad earlier.
Figure: Creating Music.mcl using the python script Now, run this file. We should see a calculator popping up as shown below.
Figure: running calc.mcl Coming to the exploitation, Microsoft says, “To exploit this vulnerability, an attacker must entice a user to install the .mcl file on the local machine. Malicious code referenced by the .mcl file could then be executed from an attacker-controlled location”. Below are the steps for successful exploitation of this vulnerability:
The attacker has to create a malicious executable file. This file must be made available for download through the malicious mcl file using UNC path. Create a malicious “.mcl” file and send it to the victim. Set up a listener. Get a shell when the victim opens the “.mcl” file.
Therefore, we first need to create a malicious file on the attacking machine, and it must be made available over UNC path so that our malicious mcl file can download it and give us a reverse shell when it is executed. Note: Malicious executable for giving us a reverse shell has been created using msfvenom’s “windows/shell_reverse_tcp” payload with 443 as a listening port. I have also created an SMB share on my attacking machine. Below is the final “exploit.mcl” file that can be passed to the victim.
We need to pass this exploit.mcl file to the victim somehow and convince him to open it. Set up a Netcat listener on port 443 since payload was created using this port.
Figure: Netcat listening on port 443 Once everything is set, open up the exploit.mcl file as shown below.
Figure: running exploit.mcl file We should get reverse shell on the Windows Machine as shown below.
Figure: reverse shell obtained using netcat listener The shell we got will have the same rights as the user logged in. In my case, “Administrator” 😉 Instead of Netcat, we can use any other listener of your choice. If you are Metasploit lover, here are the steps for you.
Figure: reverse shell obtained using Metasploit listener If you are worried about Netcat’s clear text transmissions, here is an ncat listener for you.
Figure: reverse shell obtained using the ncat listener To automate the whole process, Metasploit also has released a module for this, which is available at the following links. https://www.exploit-db.com/exploits/38195/ http://www.rapid7.com/db/modules/exploit/windows/fileformat/ms15_100_mcl_exe https://technet.microsoft.com/en-us/library/security/ms15-100.aspx#KBArticle http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2509 http://y0nd13.blogspot.my/2015/09/exploiting-cve-2015-2509-ms15-100.html
