29f0764fac
9 new exploits Joomla <= 1.0.9 (Weblinks) Remote Blind SQL Injection Exploit Joomla <= 1.0.9 - (Weblinks) Remote Blind SQL Injection Exploit Microsoft Excel Malformed FEATHEADER Record Exploit (MS09-067) Microsoft Excel - Malformed FEATHEADER Record Exploit (MS09-067) Seo Panel 2.2.0 Cookie-Rendered Persistent XSS Vulnerability Seo Panel 2.2.0 - Cookie-Rendered Persistent XSS Vulnerability VLC AMV Dangling Pointer Vulnerability VLC - AMV Dangling Pointer Vulnerability Movable Type 4.2x_ 4.3x Web Upgrade Remote Code Execution Movable Type 4.2x_ 4.3x - Web Upgrade Remote Code Execution Roxio CinePlayer 3.2 SonicDVDDashVRNav.DLL ActiveX Control Remote Buffer Overflow Vulnerability Roxio CinePlayer 3.2 - SonicDVDDashVRNav.DLL ActiveX Control Remote Buffer Overflow Vulnerability HP Client Automation Command Injection HP Client - Automation Command Injection Persistent Systems Client Automation Command Injection RCE Persistent Systems Client Automation - Command Injection RCE ElasticSearch Unauthenticated Remote Code Execution ElasticSearch - Unauthenticated Remote Code Execution ElasticSearch Search Groovy Sandbox Bypass ElasticSearch - Search Groovy Sandbox Bypass Fedora abrt Race Condition Exploit Fedora - abrt Race Condition Exploit ProFTPD 1.3.5 Mod_Copy Command Execution ProFTPD 1.3.5 - Mod_Copy Command Execution Windows ClientCopyImage Win32k Exploit Microsoft Windows - ClientCopyImage Win32k Exploit Wolf CMS Arbitrary File Upload To Command Execution Wolf CMS - Arbitrary File Upload To Command Execution Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (1) Kaseya VSA uploader.aspx Arbitrary File Upload Kaseya Virtual System Administrator (VSA) - uploader.aspx Arbitrary File Upload Samsung Galaxy S6 - Samsung Gallery Bitmap Decoding Crash Samsung Galaxy S6 Samsung Gallery - Bitmap Decoding Crash Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux 2 (MS16-008) Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (MS16-008) Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (2) (MS16-008) Windows - Sandboxed Mount Reparse Point Creation Mitigation Bypass Redux (1) (MS16-008) Microsoft Windows 7 SP1 x86 - WebDAV Privilege Escalation (MS16-016) Microsoft Windows 7 SP1 x86 - WebDAV Privilege Escalation (MS16-016) (1) NETGEAR ProSafe Network Management System 300 Arbitrary File Upload NETGEAR ProSafe Network Management System 300 - Arbitrary File Upload Windows - Secondary Logon Standard Handles Missing Sanitization Privilege Escalation (MS16-032) Microsoft Windows 8.1/10 - Secondary Logon Standard Handles Missing Sanitization Privilege Escalation (MS16-032) OS X / iOS Suid Binary Logic Error Kernel Code Execution OS X / iOS - Suid Binary Logic Error Kernel Code Execution Novell ServiceDesk Authenticated File Upload Novell ServiceDesk - Authenticated File Upload Mach Race OS X Local Privilege Escalation Exploit Mach Race OS X - Local Privilege Escalation Exploit Oracle ATS Arbitrary File Upload Oracle Application Testing Suite (ATS) - Arbitrary File Upload Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (Metasploit) HP Data Protector A.09.00 - Encrypted Communications Arbitrary Command Execution (Metasploit) WordPress Lazy Content Slider Plugin 3.4 - (Add Catetory) CSRF Hide.Me VPN Client 1.2.4 - Privilege Escalation InstantHMI 6.1 - Privilege Escalation Microsoft Process Kill Utility (kill.exe) 6.3.9600.17298 - Crash PoC Microsoft WinDbg logviewer.exe - Crash PoC Linux x86 TCP Reverse Shellcode - 75 bytes php Real Estate Script 3 - Arbitrary File Disclosure CyberPower Systems PowerPanel 3.1.2 - XXE Out-Of-Band Data Retrieval Streamo Online Radio And TV Streaming CMS - SQL Injection
56 lines
1.8 KiB
Text
Executable file
56 lines
1.8 KiB
Text
Executable file
Title: InstantHMI - EoP: User to ADMIN
|
|
CWE Class: CWE-276: Incorrect Default Permissions
|
|
Date: 01/06/2016
|
|
Vendor: Software Horizons
|
|
Product: InstantHMI
|
|
Version: 6.1
|
|
Download link: http://www.instanthmi.com/ihmisoftware.htm
|
|
Tested on: Windows 7 x86, fully patched
|
|
Release mode: no bugbounty program, public release
|
|
|
|
Installer Name: IHMI61-PCInstall-Unicode.exe
|
|
MD5: ee3ca3181c51387d89de19e89aea0b31
|
|
SHA1: c3f1929093a3bc28f4f8fdd9cb38b1455d7f0d6f
|
|
|
|
- 1. Introduction: -
|
|
During a standard installation (default option) the installer
|
|
automatically creates a folder named "IHMI-6" in the root drive.
|
|
No other location can be specified during standard installation.
|
|
|
|
As this folder receives default permissions AUTHENTICATED USERS
|
|
are given the WRITE permission.
|
|
|
|
Because of this they can replace binaries or plant malicious
|
|
DLLs to obtain elevated, administrative level, privileges.
|
|
|
|
- 2. Technical Details/PoC: -
|
|
A. Obtain and execute the installer.
|
|
|
|
B. Observe there is no prompt for the installation location.
|
|
|
|
C. Review permissions under the Explorer Security tab or run icacls.exe
|
|
|
|
Example:
|
|
|
|
IHMI-6 BUILTIN\Administrators:(I)(F)
|
|
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
|
|
NT AUTHORITY\SYSTEM:(I)(F)
|
|
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
|
|
BUILTIN\Users:(I)(OI)(CI)(RX)
|
|
NT AUTHORITY\Authenticated Users:(I)(M)
|
|
NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
|
|
|
|
Successfully processed 1 files; Failed processing 0 files
|
|
|
|
D. Change the main executable: InstantHMI.exe with a malicious copy.
|
|
|
|
E. Once executed by an administrator our code will run
|
|
under administrator level privileges.
|
|
|
|
- 3. Mitigation: -
|
|
A. Install under "c:\program files" or "C:\Program Files (x86)"
|
|
|
|
B. set appropriate permissions on the application folder.
|
|
|
|
- 4. Author: -
|
|
sh4d0wman
|