Exploits / Vulnerability Discovered : 2019-02-14 |
Type : local |
Platform : windows
This exploit / vulnerability Exacqvision esm 5.12.2 privilege escalation is for educational purposes only and if it is used you will do on your own risk!
# Description:
# exacqVision ESM 5.12.2 suffers from Privilege Escalation due to insecure file permissions
# Prerequisites
# Local, Low privilege access with restart capabilities
# Details
# By default the Authenticated Users group has the modify permission to ESM folders/files as shown below.
# A low privilege account is able to rename the enterprisesystemmanager.exe file located in
# this same path and replace with a malicious file that would connect back to an attacking computer giving system level privileges
# (nt authority\system) due to the service running as Local System. While a low privilege user is unable to restart the service
# through the application, a restart of the computer triggers the execution of the malicious file.
# note: during install, you cannot choose a folder containing spaces i.e. "program files"
C:\>icacls exacqVisionEsm
exacqVisionEsm NT AUTHORITY\NETWORK SERVICE:(RX)
win7-32bit\bob:(RX)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)