zoukankan      html  css  js  c++  java
  • Microsoft Word (2016) Deceptive File Reference ZDI-CAN-7949

    [+] Credits: John Page (aka hyp3rlinx)
    [+] Website: hyp3rlinx.altervista.org
    [+] Source:  http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WORD-DECEPTIVE-FILE-REFERENCE.txt
    [+] ISR: ApparitionSec
    [+] Zero Day Initiative Program       
     

    [Vendor]
    www.microsoft.com


    [Product]
    Microsoft Word 2016


    [Vulnerability Type]
    Deceptive File Reference


    [References]
    ZDI-CAN-7949


    [Security Issue]
    When a MS Word ".docx" File contains a hyperlink to another file, it will run the first file it finds in that directory with a
    valid extension. But will present to the end user an extension-less file in its Security warning dialog box without showing the extension type.
    If another "empty" file of the same name as the target executable exists but has no file extension. Because the extension is supressed it
    makes the file seem harmless and the file can be masked to appear as just a folder etc.

    This can potentially trick user into running unexpected code, but will only work when you have an additional file of same name with
    NO extension on it.


    [Exploit/POC]
    1) Create a directory "PoC"

    2) Create a folder in PoC directory named "Downloads Folder"

    3) Create a .BAT file named "Downloads Folder.bat"

    in the .BAT create some command like "start calc.exe"

    4) Create an empty file named "Downloads Folder" with no file extension

    5) Create the Word ".docx" file with a hyperlink pointing to "PoC/Downloads Folder/Downloads Folder"

    Upon opening the link Word will give user an vague dialog box about asking if they want to open
    the file. However, the prompt shows an apparent folder structure and no file extension .exe, .com etc
    are visible or displayed to the end user.

    Click the link to open what looks to be a folder then BOOM! the .BAT file runs instead.

    Of course any exeuctable will do .EXE etc.


    [Network Access]
    Local


    [Severity]
    High


    [POC Video URL]
    https://www.youtube.com/watch?v=irxkV_qGG9Y


    [Disclosure Timeline]
    Notification: Trend Micro Zero Day Initiative Program : 2019-01-25

    Case officially contracted to ZDI : 2019-02-06

    Vendor Disclosure : 2019-02-15
    submitted to the vendor as ZDI-CAN-7949.

    ZDI Response : "We have synced with the vendor and they have resolved that this case
    does not meet the bar for security servicing. Therefore we will proceed to close it on our end."

    2019-06-14 : Public Disclosure



    [+] Disclaimer
    The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
    Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
    that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
    is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
    for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
    or exploits by the author or elsewhere. All content (c).

    hyp3rlinx

  • 相关阅读:
    课程作业02
    课后作业01
    大道至简第一章伪代码
    《大道至简》读后感
    Codeforces 959 F. Mahmoud and Ehab and yet another xor task
    Codeforces 992 E. Nastya and King-Shamans
    Codeforces 835 F. Roads in the Kingdom
    Codeforces 980 D. Perfect Groups
    洛谷 P4315 月下“毛景树”
    JDOJ 1234: VIJOS-P1052 高斯消元
  • 原文地址:https://www.cnblogs.com/iAmSoScArEd/p/11041666.html
Copyright © 2011-2022 走看看