Multiple ManageEngine Applications Critical Information Disclosure Vulnerability
The NTLMv2 hash of the domain user or the computer accounts, can be obtained coercing the target server authenticates an arbitrary SMB server. (CVE-2022-29457)
# Introduction
I have detected this vulnerability on the ADSelfService Plus Build 6118 first.
In most cases, ADSelfService Plus application is installed with high domain user privileges. For exploitation it doesn't matter where application is installed. The important point is that the application runs under which privileges (domain user or service).
When scheduling report, the ADSelfService application exports report files to a local or network path. If I specify a SMB server on the network , the server that hosts ADSelfService authenticates the SMB server to export file. The NTLMv2 hash of the domain user or the computer accounts, can be obtained while the authentication is conducting. Relaying the captured hash can cause a privilege escalation in the Active Directory environment.
I noticed that the "schedule report" functionality is inclued in the ADManager Plus, ADAudit Plus, Exchange Reporter Plus. These applications are impacted the same vulnerability.
# Detecting the Vulnerability
There is a scheduling report functionality and the Operator user can schedule a report default. While the Operator user sends reports to an email, it is stored C:\ManageEngine\ADSelfService Plus\audit-data
as default.
For the storage path value , there is a character restriction ( / : * ? < > | "
). However, it is checked by the front-end only so it can be bypassed using the proxy. Also, the \
character is not restricted.
If you set STORAGE_PATH
parameter as /../../bypass
or C:\bypass
through Burp, the reports is extracted to C:\bypass
directory.
The Operator user that doesn't have admin privileges can manipulate this scheduling report functionality. If the storage path is a remote file share, the server which hosts the ADSelfService application authenticates to the specified server for storing reports. When authenticating, the NTLMv2 hash is captured.
The user can set storage path as \\IP\share
and the server authenticates to the remote address with privileges of the ADSelfService process. There are two options:
The ADSelfService runs as a service
The ADSelfService runs with domain user privileges
The NTLMv2 hash of the computer account can be captured for the first option and the NTLMv2 hash of the domain user can be captured for the second. After the capturing the hash value, it can be relayed to other servers which are SMB singing or LDAP signing (for DC) is disabled.
If you capture the NTLMv2 hash of computer account, relay it to a server that the computer account is added as a local admin user.
If the ADSelfService runs on the DC as a service, you can capture the NTLMv2 hash of the Domain Controller account, relay it to the another Domain Controller through LDAP and gain high privileges.
# Exploitation
When the ADSelfService runs with domain user privileges (the user has high privileges in most cases):
The ADSelfService runs with Domain Admin user privileges for my scenario. However, it is not a requirement for exploitation.
Set up a SMB Server
Login the ADSelfService application as operator user. Then create schedule report and set the store path as \\smb-server\share
Capture and try cracking the NTLMv2 hash.
As a more exploitable scenario, the captured hash can be relayed to another computer which SMB signing is disabled using ntlmrelayx
.
The SMB Signing is disabled default, if the host is not a Domain Controller.
If the compromised user has sufficient privileges, dumping the NT hash of local users and command execution on the remote machine are possible.
As another option, the captured hash can be relayed to another Domain Controller.
When the ADSelfService runs as a service
If the ADSelfService runs as a service on the Domain Controller. Exploiting this vulnerability, capture the hash of the Domain Controller account and relay it to another one or the ADCS.
From SMB to LDAP will only be possible if the target is vulnerable to CVE-2019-1040 or CVE-2019-1166.
After setting ntlmrelayx
, login the ADSelfService application as operator user. Then create schedule report and set the store path as \\smb-server\share
Since the report is generated every five minutes, the DC authenticates to SMB server after five minutes.
The exploit:
# Other ManageEngine Applications
ADManagerPlus Build 7131, ADAuditPlus Build 7060, Exchange Reporter Plus Build 5701 are impacted same NTLMv2 hash information disclosure vulnerability.
There are too many user role types in the applications. The scheduling report permission is enough to exploit the vulnerability. If a technician user has scheduling report privilege, he can obtain the NTLMv2 hash of user that runs applications. If applications are installed as a service, the NTLMv2 hash of computer account can be obtained.
The technician user must have the following permissions on the ADManagerPlus:
The technician user must have the following permissions on the ADAuditPlus:
The technician user must have the following permissions on the Exchange Reporter Plus:
For capturing the NTLMv2 hash:
Login the application technician user. Then create schedule report and set the store path as \\smb-server\share
When the reports are generated, the hash is obtained.
# The Patch
The vulnerability has been fixed in ADSelfService Build 6121. You can see the release notes.
I take a look at source code after the patch. If you are not a admin user and the storage path starts with \\
. You will be blocked with adssp.reports.schedule_reports.storage_path.unc_storage_path
code.
If you are an admin user, you can still obtain the NTLMv2 hash.
Last updated