{"id":476,"date":"2021-08-17T09:01:06","date_gmt":"2021-08-17T09:01:06","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=476"},"modified":"2021-08-22T04:59:07","modified_gmt":"2021-08-22T04:59:07","slug":"exploit-win32-cve-2017-8759-a","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2021\/08\/17\/exploit-win32-cve-2017-8759-a\/","title":{"rendered":"Exploit.Win32.CVE.2017.8759.a"},"content":{"rendered":"<h2 style=\"text-align: justify\"><strong>General Explanation<\/strong><\/h2>\n<p style=\"text-align: justify\"><strong>Type:<\/strong> Vulnerability<\/p>\n<p style=\"text-align: justify\"><strong>Vulnerability platform:<\/strong> .Net Framework<\/p>\n<p style=\"text-align: justify\"><strong>Vulnerable versions:<\/strong><\/p>\n<ul>\n<li style=\"text-align: justify\">Microsoft .NET Framework 4.6.2<\/li>\n<li style=\"text-align: justify\">Microsoft .NET Framework 4.6.1<\/li>\n<li style=\"text-align: justify\">Microsoft .NET Framework 3.5.1<\/li>\n<li style=\"text-align: justify\">Microsoft .NET Framework 4.7<\/li>\n<li style=\"text-align: justify\">Microsoft .NET Framework 4.6<\/li>\n<li style=\"text-align: justify\">Microsoft .NET Framework 4.5.2<\/li>\n<li style=\"text-align: justify\">Microsoft .NET Framework 3.5<\/li>\n<li style=\"text-align: justify\">Microsoft .NET Framework 2.0 SP2<\/li>\n<\/ul>\n<p style=\"text-align: justify\"><strong>Patch release date by Microsoft Co.:<\/strong> September 12th, 2017<\/p>\n<p style=\"text-align: justify\"><strong>Vulnerability module:<\/strong> WSDL parser<\/p>\n<p style=\"text-align: justify\"><strong>Vulnerability type:<\/strong> Remote Code Execution (RCE)<\/p>\n<p style=\"text-align: justify\"><strong>Risk rate:<\/strong> Extremely high (CVSS 9.3)<\/p>\n<h3 style=\"text-align: justify\"><strong>What is Vulnerability?<\/strong><\/h3>\n<p style=\"text-align: justify\">In computer security, vulnerability means a weak point in a platform that can be exploited by an intruder or malware and provides unauthorized access to the computer system. With this vulnerability, the intruder can execute instructions, access the system storage, install malware, steal information, destruct and change critical organizational and individual data.<\/p>\n<h3 style=\"text-align: justify\">How is CVE-2017-8759 vulnerability being exploited?<\/h3>\n<p style=\"text-align: justify\">Exploiting CVE-2017-8759 vulnerability starts with executing a destructive object of an RTF or DOC formatted file. The harmful file sent a SOAP request to its server by this method, and in return, received a packet contains codes related to exploiting the vulnerability. As a result, an intruder must first convince the victim to, somehow, execute the destructive document, which is usually happening through email.<\/p>\n<h2 style=\"text-align: justify\">Technical Explanation<\/h2>\n<h3 style=\"text-align: justify\">Vulnerability details<\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-479 aligncenter\" src=\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/08\/CVE-2017-87591.jpg\" alt=\"CVE-2017-8759(1)\" width=\"732\" height=\"123\" \/><\/p>\n<p style=\"text-align: center\">Figure 1- Contents of a destructive DOC file<\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: justify\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-480 aligncenter\" src=\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/08\/CVE-2017-87592.jpg\" alt=\"CVE-2017-8759(2)\" width=\"730\" height=\"141\" \/><\/p>\n<p style=\"text-align: center\">Figure 2- Contents of a destructive RTF file<\/p>\n<p style=\"text-align: justify\">This vulnerability is in the WsdlParser class from System.Runtime.Remoting occurred with injecting the code. CRLF characters in the sending strings to the IsValidUrl function result in a problem when we call PrintClientProxy from this class.\u00a0Carriage Return (r\\ or 0x0D) and Line Feed (n\\ or 0x0A) are two control characters to show a line break in a text. This, allows the intruder to inject and execute destructive codes on the system.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-481 aligncenter\" src=\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/08\/CVE-2017-87593.jpg\" alt=\"CVE-2017-8759(3)\" width=\"732\" height=\"402\" \/><\/p>\n<p style=\"text-align: center\">Figure 3- Calling\u00a0 IsValidUrl lines in PrintClientProxy<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-482 aligncenter\" src=\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/08\/CVE-2017-87594.jpg\" alt=\"CVE-2017-8759(4)\" width=\"555\" height=\"491\" \/><\/p>\n<p style=\"text-align: center\">Figure 4- Contents of IsValidUrl vulnerability<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-483 aligncenter\" src=\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/08\/CVE-2017-87595.jpg\" alt=\"CVE-2017-8759(5)\" width=\"729\" height=\"455\" \/><\/p>\n<p style=\"text-align: center\">Figure 5- Contents of corrected IsValidUrl function<\/p>\n<p style=\"text-align: justify\">In a SOAP response, the <code>\u201c\/\/base.ConfigureProxy(this.GetType(),\u201d<\/code> string will add as an ending to the first address by PrintClientProxy function when adding more than one address as the WSDL entry. If there is a CRLF string in the next address, the following value after this string is executing.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-484 aligncenter\" src=\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/08\/CVE-2017-87596.jpg\" alt=\"CVE-2017-8759(6)\" width=\"690\" height=\"488\" \/><\/p>\n<p style=\"text-align: center\">Figure 6- Contents of received SOAP response from malware server<\/p>\n<p style=\"text-align: justify\">After sending the request, the server will send the destructive SOAP contents by executing the object inside the harmful file. WsdlParser class in the .NET Framework analyzes the contents of the received packet and creates a .cs file in the active directory. Then the codes of this file related to the .NET Framework are compiled by the scs.exe process and creates a dll file. This file was uploaded in memory by Microsoft Office.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-485 aligncenter\" src=\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/08\/CVE-2017-87597.jpg\" alt=\"CVE-2017-8759(7)\" width=\"723\" height=\"184\" \/><\/p>\n<p style=\"text-align: center\">Figure 7- Created files after executing destructive file<\/p>\n<p style=\"text-align: justify\">You can see the logo.cs file code in the format of dll compiled file:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-486 aligncenter\" src=\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2021\/08\/CVE-2017-87598.jpg\" alt=\"CVE-2017-8759(8)\" width=\"730\" height=\"380\" \/><\/p>\n<p style=\"text-align: center\">Figure 8- Executed harmful codes in the format of dll file<\/p>\n<h2 style=\"text-align: justify\">Security Recommendation<\/h2>\n<p style=\"text-align: justify\">Download and install the represented security patch (<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2017-8759\" target=\"_blank\" rel=\"noopener\">CVE-2017-8759<\/a>) by Microsoft Co.<\/p>\n<h3 style=\"text-align: justify\">How to deal with it and disinfect the system<\/h3>\n<p style=\"text-align: justify\">The intrusion Prevention System (IPS) of <a href=\"https:\/\/padvish.com\/en-us\/Main\" target=\"_blank\" rel=\"noopener\">Pavish Antivirus<\/a> detects and prevents every attempt to create infection through this vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>General Explanation Type: Vulnerability Vulnerability platform: .Net Framework Vulnerable versions: Microsoft .NET Framework 4.6.2 Microsoft .NET Framework 4.6.1 Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.7 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 3.5 Microsoft .NET Framework 2.0 SP2 Patch release date by Microsoft Co.: September 12th, 2017 Vulnerability module: WSDL&hellip;<\/p>\n","protected":false},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[16,22],"class_list":["post-476","post","type-post","status-publish","format-standard","hentry","category-exploit","tag-ips","tag-net-framework"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/476","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=476"}],"version-history":[{"count":11,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/476\/revisions"}],"predecessor-version":[{"id":562,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/476\/revisions\/562"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=476"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=476"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=476"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}