Huawei UTPS – Unquoted Service Path Privilege Escalation
# Exploit Title: Unquoted Service Path Vulnerability in Huawei UTPS Software # Date: Nov 16 2016 # Author: Dhruv Shah (@Snypter) # Website: http://security-geek.in # Contact: dhruv-shah@live.com # Category: local # Vendor Homepage: http://www.huawei.com/ # Version: Versions earlier than UTPS-V200R003B015D16SPC00C983 # Tested on: Windows XP , Windows 7-10 x86/x64 # CVE: CVE-2016-8769 1. Description Huawei UTPS Software is the core software that is bundled with the Internet Dongles, it provides it dongles to companies like Airtel , TATA Photon . This is the software that installs itself for the Dongle to run on the attached machine. It installs as a service ("Photon. RunOUC") and ("Airtel. RunOuc") with an unquoted service path running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. 2. Proof of Concept ( TATA PHOTON Dongles) C:\Documents and Settings\Dhruv>sc qc "Photon. RunOuc" [SC] GetServiceConfig SUCCESS SERVICE_NAME: Photon. RunOuc TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Program Files\Photon\Huawei\EC306-1\UpdateDog\ouc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Photon. OUC DEPENDENCIES : SERVICE_START_NAME : LocalSystem ( Airtel Dongles) C:\Documents and Settings\Dhruv>sc qc "airtel. Runouc" [SC] GetServiceConfig SUCCESS SERVICE_NAME: airtel. Runouc TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Program Files\airtel\UpdateDog\ouc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : airtel. OUC DEPENDENCIES : SERVICE_START_NAME : LocalSystem 3. Exploit: A successful attempt would require the local attacker must insert an executable file in the path of the service. Upon service restart or system reboot, the malicious code will be run with elevated privileges. Additional notes : Fixed in version UTPS-V200R003B015D16SPC00C983 CVSSv3 Risk Rating Base Score: 6.4 (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H ) Temporal Score: 5.9 (E:F/RL:O/RC:C) Vulnerability Disclosure Timeline: ========================= 06/09/2016 - Contact With Vendor 06/09/2016 - Vendor Response 15/11/2016 - Release Fixed Version |