{"id":13845045,"url":"https://github.com/ariary/DogWalk-rce-poc","last_synced_at":"2025-07-12T00:33:03.512Z","repository":{"id":38616489,"uuid":"502062433","full_name":"ariary/DogWalk-rce-poc","owner":"ariary","description":"🐾Dogwalk PoC (using diagcab file to obtain RCE on windows)","archived":false,"fork":true,"pushed_at":"2022-08-11T08:59:20.000Z","size":3016,"stargazers_count":79,"open_issues_count":1,"forks_count":14,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-08-05T17:43:33.994Z","etag":null,"topics":["dogwalk","microsoft","pentest","poc","rce"],"latest_commit_sha":null,"homepage":"","language":"Perl","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"irsl/microsoft-diagcab-rce-poc","license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ariary.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-06-10T13:55:44.000Z","updated_at":"2024-04-30T18:14:16.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/ariary/DogWalk-rce-poc","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ariary%2FDogWalk-rce-poc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ariary%2FDogWalk-rce-poc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ariary%2FDogWalk-rce-poc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ariary%2FDogWalk-rce-poc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ariary","download_url":"https://codeload.github.com/ariary/DogWalk-rce-poc/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225772869,"owners_count":17521905,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dogwalk","microsoft","pentest","poc","rce"],"created_at":"2024-08-04T17:03:08.830Z","updated_at":"2024-11-21T17:31:13.011Z","avatar_url":"https://github.com/ariary.png","language":"Perl","funding_links":[],"categories":["Perl"],"sub_categories":[],"readme":"\u003cdiv align=center\u003e\n\u003ch1\u003e Dogwalk Proof-of-Concept🐾\u003c/h1\u003e\n\u003cpre\u003e\u003ccode\u003e\n\u003ch\u003e\u003cstrong\u003e🚨 Disclaimer 🚨\u003c/strong\u003e\u003c/h4\u003e\n\n\u003cbr\u003e\u003cbr\u003eThe PoC allows an attacker to obtain \u003cstrong\u003eRemote Code Injection\u003c/strong\u003e on a Windows victim device.\n\u003cbr\u003eThe goal of this repo is to make a PoC even more usable than the \u003ca href=https://github.com/irsl/microsoft-diagcab-rce-poc\u003einitial repo\u003c/a\u003e.\n\u003cbr\u003eDO NOT USE IT WITHOUT PRIOR AUTHORIZATION!\n\u003cbr\u003e\u003cbr\u003e\u003ci\u003eRegarding the damage caused and the simplicity of exploitation, \u003cstrike\u003eI hope Microsoft will fix it\u003c/strike\u003e\n\u003cbr\u003e\u003cb\u003eUpdate July 2022:\u003c/b\u003e Microsoft has not patched yet the vulnerability in msdt but Microsoft Defender is able to spot it\u003c/i\u003e\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/div\u003e\n\n* [🧠 Understand it](#how-it-works)\n* [🐾 Run it](#lets-get-it)\n* [📺 Show Me](#%EF%B8%8F-wait-and-see)\n\n***Core concept:*** path traversal vulnerability in Microsoft's Diagcab technology (`msdt`) that could lead to remote code execution.\u003cbr\u003e\nYou can find the full advisory in the [blog post](https://medium.com/@radimre83/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd)\u003cbr\u003e\nThe vulnerability has been reported for **2 years** (by [@irsl](https://github.com/irsl)) and still has **no fix**!\n\n\n\n\n## How it works?\n\nThe Proof-of-Concept sets up a webdav server hosting a malicious `.diagcab` file that will perform a path transversal to write a malicious executable in `C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup`. Writing an executable in this folder will execute it each time the user starts the windows machine, this is called ***Boot Logon Autostart Execution***.\n\nSo, basically what we need is:\n* webDAV server\n* Malicious `.diagcab` file\n* Malicious executable *(legit one or basic text file is sufficient for the PoC)*\n\n### 🎬 Scenario\n\n1. The victim will visit a link (phishing, social engineering, or whatever) that will download the `.diagcab` file\n\n\u003csup\u003e*(💡 use `Content-type: application/octet-stream` response header to make the Browser automaticaly downloading the file when browsing the url)*\u003c/sup\u003e\n\n2. The victim click on the file download (could easily/accidentaly happen by just clicking on the browser download folder)\n3. The cab file loads the webdav malicious executable -\u003e ***(path transversal)*** downloaded in Start up menu\n4. The user restart his device -\u003e ***(RCE)***\n\n## Let's get it\n\nIf you are too lazy (or in a hurry) to proceed step-by-steps:\n```shell\n./hurry-dogwalk.sh [WEBDAV_URL]         # need docker\n# Stop the server\n./hurry-dogwalk.sh --clean\n```\n\nOtherwise ↓↓\n\n### 🔨 Craft the  `.diagcab` file\n\n* `.diagcfg` are simple XML files that hold reference to one or more diagnostic packages and provide meta information about them\n* They are packaged into Microsoft cabinet file archives and saved with `.diagcab` extension.\n\nFirt build `custom.diagcfg`:\n```shell\n./build-malicious-diagcfg.sh --url [WEBDAV_URL]\n```\n\nAnd build the `hotfix895214.diagcab`:\n```shell\ncabarc.exe n hotfix895214.diagcab custom.diagcfg\n# run it on windows (or with wine). If you do not find carbarc.exe use http://jc.bellamy.free.fr/download/cabarc.exe or http://download.microsoft.com/download/platformsdk/cab/2.0/w98nt42kmexp/en-us/Cabsdk.exe\n```\n\nFinally, move it in the `./webdav/diagcab-webdav-poc/config` directory\n\n### 🏗️ Set up the server\n\nPut the executable you want to transfer on victim machine within `./webdav/malicious` directory... \u003csup\u003e*(Here we use the classic `calc.exe`)*\u003c/sup\u003e\n\n...And launch the server:\n```\ncd ./webdav/diagcab-webdav-poc/\nperl diagcab-webdav-poc.pl\n```\n\nThe malicious `.diagcab` is available at `https://[WEBDAV_URL]/config/hotfix895214.diagcab`. You now have to lure a victim to click on this link.\n\n\u003csup\u003e*(💡you can use URL shortener to make it appears less suspicious)*\u003c/sup\u003e\n\n### 👁️ Wait and see\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eDogwalk set up\u003c/b\u003e\u003c/summary\u003e\n\u003cdiv align=center\u003e\n\u003cimg src=https://github.com/ariary/Dogwalk-rce-poc/blob/master/img/dogwalk_setup.gif\u003e\n\u003c/div\u003e\n\u003ci\u003e\n\u003cbr\u003e 💡 by default, it seems that webdav communication are not enabled. See \u003ca href=./mitigations.txt\u003emitigations.txt\u003c/a\u003e to get a workaround to make it work\u003c/i\u003e\n\u003c/details\u003e\n\n🐾🐾\n\n![demo](https://github.com/ariary/Dogwalk-rce-poc/blob/master/img/dogwalk_exploit.gif)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fariary%2FDogWalk-rce-poc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fariary%2FDogWalk-rce-poc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fariary%2FDogWalk-rce-poc/lists"}