One of the few interesting exploits that I could find includes the ability to download the source code of ASPX pages whose address is known in advance and accessible from outside. This vulnerability exists only in SharePoint 2007, and the exploit is quite simple:

http://www.example.com/_layouts/download.aspx?SourceUrl=/Pages/Default.aspx&Source=http://www.example.com/Pages/Default.aspx&FldUrl=

This could be useful, if the website has proprietary code. But you still need to know the address of specific page.

By digging a little deeper, I found that SharePoint contains a number of interesting web services that can be accessed by a user who logged into the website with read rights.

You can find these services and their description in the directory ‘_vti_bin’. Here are a couple of examples of what the path may look like:

http://host/_vti_bin
http://host/sites/testsite/_vti_bin

This directory and services are bound directly to the website hosted on SharePoint Server. That is, if I have several websites in ‘host/sites/’, then, to take full advantage of this technique, I need to access services within the directory of each website. Describing all these services in this article doesn’t make sense. I will discuss a couple of those that allowed me to successfully grab someone else’s domain account during an internal audit.

Fig. 1. List of Services in ‘_vti_bin’

 

Recon

So, we have a website on SharePoint, and we can log into it. To grab someone else’s account, it is a good idea to know his/her name and whether he/she represents any interest. Here, you can fight by using an old technique of listing the users, which may look like this:

https://host/_layouts/UserDisp.aspx?ID=1

Increment ID, and read the information about the user (Fig. 2).

Fig. 2. User Info

 

But what to do, if the company has ‘over 9000’ users? It is very time-consuming and inconvenient to always increment manually or write your own script and attach to it the functionality of NTLM or KERBEROS domain authentication. In this case, you can rely on services that I have already mentioned. These include a very interesting service ‘UserGroup.asmx’, which allows you to get, at once, the list of all users of the website in the form of XML by using a single query.

This query is quite simple:

POST /sites/testsite1/_vti_bin/UserGroup.asmx HTTP/1.1
Host: host
[…]
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <GetUserCollectionFromSite xmlns="http://schemas.microsoft.com/sharepoint/soap/directory/" />
  </soap:Body>
</soap:Envelope>

As a result, we have an XML document with the list of all users (see. Fig. 3).

Fig. 3. XML Document with User List

 

Fig. 4 and 5 show that we get, at once, the list of all users of the website, including their e-mail addresses, SID, ID, etc.

Continue Reading 🡒