Telefonica O2 Connection Manager 3.4 – Local Privilege Escalation

• Exploit Database
• 113 阅读

• 作者： LiquidWorm
  日期： 2014-10-14
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/34966/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119

  Telefonica O2 Connection Manager 3.4 Local Privilege Escalation Vulnerability     Vendor: Telefonica S.A. Product web page: http://www.telefonica.com | http://www.o2.co.uk Affected version: 3.4.R1 (108)   Summary: O2 Connection Manager will help you to manage your internet connections by getting you connected to the fastest available network. Automatically connect you to the fastest available network including your home broadband if you have a wireless router.   Desc: O2 Connection Manager suffers from an elevation of privileges vulnerability which can be used by a simple user that can change the executable files with a binary of choice. The vulnerability exist due to the improper permissions, with the 'F' flag (Full) for 'Everyone' group, making the entire directory 'O2 Connection Manager' and its files and sub-dirs world-writable.   Tested on: Microsoft Windows 7 Professional SP1 (EN) Microsoft Windows 7 Ultimate SP1 (EN)     Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience     Advisory ID: ZSL-2014-5199 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5199.php     22.09.2014   ---   ==========================================================================   Arguments Used: Filename = "C:\Program Files (x86)\O2CM-CE\O2 Connection Manager"       ************************************************************************** Directory: C:\Program Files (x86)\O2CM-CE\O2 Connection Manager   Permissions: Type UsernamePermissions Inheritance   Allowed\Everyone Full ControlThis Folder Only Allowed\Everyone Special (Unknown) Files Only AllowedBUILTIN\AdministratorsSpecial (DCBA654321)This Folder and Files AllowedNT SERVICE\TrustedInsta Full ControlThis Folder Only AllowedNT SERVICE\TrustedInsta Special (Unknown) Subfolders only AllowedNT AUTHORITY\SYSTEM Full ControlThis Folder Only AllowedNT AUTHORITY\SYSTEM Special (Unknown) Subfolders and Files AllowedBUILTIN\AdministratorsFull ControlThis Folder Only AllowedBUILTIN\AdministratorsSpecial (Unknown) Subfolders and Files AllowedBUILTIN\Users Read and ExecuteThis Folder Only AllowedBUILTIN\Users Special (Unknown) Subfolders and Files Allowed\CREATOR OWNERSpecial (Unknown) Subfolders and Files   No Auditing set   Owner: NT AUTHORITY\SYSTEM **************************************************************************     Operation Complete Elapsed Time: 0,234375 seconds.     ==========================================================================   Arguments Used: Filename = "C:\Program Files (x86)\O2CM-CE\O2 Connection Manager\tscui.exe"       ************************************************************************** File: C:\Program Files (x86)\O2CM-CE\O2 Connection Manager\tscui.exe   Permissions: Type UsernamePermissions Inheritance   Allowed\Everyone Full ControlThis Folder Only AllowedBUILTIN\AdministratorsSpecial (DCBA654321)This Folder Only AllowedNT AUTHORITY\SYSTEM Full ControlThis Folder Only AllowedBUILTIN\AdministratorsFull ControlThis Folder Only AllowedBUILTIN\Users Read and ExecuteThis Folder Only   No Auditing set   Owner: NT AUTHORITY\SYSTEM **************************************************************************     Operation Complete Elapsed Time: 0,125 seconds.     ==========================================================================   C:\Program Files (x86)\O2CM-CE\O2 Connection Manager>icacls *.exe |findstr "Everyone:(I)(F)" Elevate.exe Everyone:(I)(F) locSrch.exe Everyone:(I)(F) md5sum.exe Everyone:(I)(F) patch.exe Everyone:(I)(F) ProfileImp.exe Everyone:(I)(F) SupportAssistant.exe Everyone:(I)(F) tscui.exe Everyone:(I)(F) vcredist_x86.exe Everyone:(I)(F) WifiProfileImportTool.exe Everyone:(I)(F) XAU.exe Everyone:(I)(F)   C:\Program Files (x86)\O2CM-CE\O2 Connection Manager>   ==========================================================================