Exploit-DB #47981
Description: Microsoft Windows Media Center WMV / WMA 6.3.9600.16384 - Code Execution
Type: local
Platform: windows
Date: 2020-01-30
Author: Eduardo Braun Prado

Exploit:
# Exploit Title: Microsoft Windows Media Center WMV or WMA 6.3.9600.16384 - Code Execution
# Google Dork: n/a
# Date: 2020-01-29
# Exploit Author: Eduardo Braun Prado
# Vendor Homepage: http://www.microsoft.com/
# Software Link: http://www.microsoft.com/
# Version: 6.3.9600.16384
# Tested on: Windows 7, 8.1, 10
# CVE : N/A
# Discovered by: Eduardo Braun Prado

# Microsoft Windows Media Center WMV/WMA File FormatParsing Security Bypass Arbitrary Code Execution Vulnerability PoC - C#
[Details]

Microsoft Windows Media Center, the very popular app still used by many
people, (that can play a variety of file types and originally designed
for playback and recording of TV shows from TV´s cable/antenna) is
affected by an issue that allows malicious people to bypass the current
security standards of the app,

including modern browser security standards which could ultimately lead
to arbitrary code execution.

The issue can be exploited through specially crafted 'wma' or 'wmv' file
containing a script instruction called 'URL'.


1) Currently Windows Media Center prompts before opening links no matter
what protocol is used (eg. 'http:' versus 'file:')

If the user accepts the prompt it will be passed to the default web browser.

2) Windows Media Center allows unsafe 'file:' URIs, which facilitates
attacks that abuses local file system access.


By combining these 2 issues attackers may be able to reference a local
html file in the context of MS IE core, which is hosted

by a Media Center 'plugin' (ehexthost32). Because usually local files
are parsed in the privileged Local Machine security zone,
it´s possible to run arbitrary code on the target system, because:

- Windows Media Center´s extensibility host (ehexthost32) does not
enable the security feature 'Local Machine Zone Lockdown'
(FEATURE_LOCALMACHINE_LOCKDOWN)

Therefore attackers might be able to compromise the target system if
they can exploit an Universal Cross Site Scripting (uXSS) issue,

or plant a file in a predictable location, with custom content.

If it used the 'FEATURE_LOCALMACHINE_LOCKDOWN', the severity of the
attack could be considerably reduced.


2 PoCs are provided.


The first assumes the attacker could have already planted an html based
file on the target and the user saved/copied the WMV video
to his/her 'Videos' folder.

So, by opening Windows Media Center and navigating through the resources
displayed on the screen (click "Videos", then an embedded file browser is

displayed, so you can click the PoC WMV file) it will start playing the
video and exploit will be triggered.


The second involves the target user opening an ASX playlist that
references the first WMV file that could be located on a web site or
SMB/WebDAV location

and further displaying a picture with text 'Click me'. Upon playing the
first WMV file, an 'HTTP:' URL is displayed (it belongs to the default
'Internet'
security zone of Windows) and by this time the attacker either uses a
predictable file creation issue or a uXSS vulnerability. In case the
attacker does not
have a mean to navigate from the 'Internet' zone to the 'Local Machine'
zone, when the target clicks the picture, the second WMV file is played
and it contains
code to retrieve a local file, using the 'file:' URL protocol. Windows
Media Center was supposed to either changing the location of the current
window or
opening a new one (on the same or new instance of 'Ehexthost32' app),
but due to a "bug" it freezes in the first URL.

The "FEATURE_ZONE_ELEVATION", used by 'Ehexthost32' app sets additional
security regarding zone elevation blocks, in other words, makes it
harder to navigate
from the 'Internet' (or even 'Trusted Sites' and 'Local Intranet') zone
to the 'Local Machine'.

The PoCs use the 'System Monitor Control' ActiveX to create a simple WSH
file (shortcut to script files) to the user´s startup dir.
This is possible because code is parsed in the context of the Local
Machine zone ("unlocked") of Windows.


[video demo]

video demo1: https://www.youtube.com/watch?v=ubom8OMjfDw

video demo2: https://www.youtube.com/watch?v=ECto30VbiHk


[PoC]

Instructions:

 - Create a new project on MS Visual Studio (any version, included free
ones like 'Express'), choose 'Console Application'

and at 'program . cs' replace the code with the code below; After
compiled, the binary can be run without parameters (creates PoC1) or
with 3 parameters which are:

1) remote URL:  an internet address you wish, eg. your website...it
could have eg. code to plant a predictable file on the target.
2) local URL: a 'file:' based address to referenced an arbitrary local
file (eg. you could have just planted a predictable file, now you wish
to retrieve it)
3) SMB path: path to your SMB server (must allow anonymous access) where
a custom script file is located and will be run on next boot.

Note: Source code targets dot NET 4.0 and up (previous versions might
work fine though!)


using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Runtime.Remoting.Metadata.W3cXsd2001;

namespace wmc_wmv
{
    class Program
    {
        static void Main(string[] args)
        {
            String exeDir = AppDomain.CurrentDomain.BaseDirectory;
            Directory.SetCurrentDirectory(exeDir);

            string welcome = "\n\n
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
\n Microsoft Windows Media Center '.wmv' Security Bypass Vulnerability
Arbitrary Code Execution \n\n by: Eduardo Braun Prado \n\n
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++";
          
            string howto = "\n\n Usage: wmc_wmv URL_Remote URL_Local
SMBPath \n\n\n Note: If you don´t pass any arguments, we use PoC1.";