Pre2k Directory Traversal + Arbitrary File Write

[rhburt]

Describe the bug
Two vulnerabilities exist in the current implementation of the Pre2k module, and when combined they can be used to achieve RCE.

The code implicitly trusts the domain (when -d parameter is not specified) and samAccountName returned within the LDAP response without sanitization. It uses the supplied domain when forming the path to write the output files. If the user supplies a string in place of the domain with ../ included, they will be able to write the precreated_computers.txt file anywhere on the nxc user's system. As the sameAccountName string isn't validated and directly written as the entire file contents, the malicious LDAP server is able to write any amount of arbitrary text to this file.

NetExec/nxc/modules/pre2k.py

Lines 57 to 69 in b7c0f65

	domain_dir = os.path.join(f"{NXC_PATH}/modules/pre2k", connection.domain)
	output_file_pre2k = os.path.join(domain_dir, "precreated_computers.txt")
	output_file_non_pre2k = os.path.join(domain_dir, "non_precreated_computers.txt")
	# Create directories if they do not exist
	os.makedirs(domain_dir, exist_ok=True)
	with open(output_file_pre2k, "w") as pre2k_file, open(output_file_non_pre2k, "w") as non_pre2k_file:
	for computer, uac in computers.items():
	if int(uac) == 4128:
	pre2k_file.write(f"{computer}\n")
	else:
	non_pre2k_file.write(f"{computer}\n")

These two vulnerabilities, when combined, allow RCE on the nxc user's system simply by probing a malicious LDAP server with the pre2k module. A working PoC for this is available upon request.

To Reproduce

netexec ldap 10.10.10.10 -u username -p password -M pre2k

With an LDAP server that will respond with the following attributes:

defaultNamingContext = "DC=test,DC=local/../../../../../../../../../<any dir path>"
sAMAccountName = "<any file contents>"

Expected behavior
The domain supplied by the target system must be properly sanitized to ensure directory traversal is not possible.

The samAccountName must be validated against the Microsoft documentation found here.

NetExec info

• OS: Kali
• Version of nxc: 1.5.1 - Yippie-Ki-Yay - Kali Linux -
• Installed from: source

NOTE
A CVE has been filed with MITRE for this issue.

[NeffIsBack]

Hi and thanks for the report.

So, it is good that you report issues of which you think have a security impact, but you should not just post them on a GitHub issue. Instead these should only be responsibly disclosed via Security Advisories!
In addition, please provide a PoC via the Security Advisories such that it is not visible to the public! So far this looks to me like you can misplace the file into arbitrary locations on the file system which we consider a bug but not with security impact. Feel free to convince me otherwise.

NOTE
We might decline a request for a CVE if we find that the issue does not have any security implications.

[rhburt]

Apologies, I looked for previous similar disclosures and found this issue which was disclosed in this way.

Feel free to delete this issue and and I will resubmit under Security Advisory.

[NeffIsBack]

I think it's fine for now because at the moment I don't see a way to actually exploit the misplacement of the file, but even if someone else does it differently, you should never just post vulnerabilities on issues when you think they could be exploited. In the end this is public.

Iirc, in the case of that issue, the vuln was communicated to one of our maintainers through a different channel first.

[rtfmkiesel]

@rhburt How exactly is this a RCE vuln? You can place a precreated_computers.txt file with arbitrary contents anywhere, true. But what vector is then used for RCE?

[rhburt]

@rtfmkiesel A PoC was submitted under a security advisory. It was the maintainer's decision to leave this issue up, and I won't be providing further details. It appears this issue will be solved with PR #1243