Druva inSync client for Windows exposes a network service on TCP port 6064 on the local network interface. inSync versions 6.5.2 and prior do not validate user-supplied program paths in RPC type 5 messages, allowing execution of arbitrary commands as SYSTEM. This Metasploit module has been tested successfully on inSync version 6.5.2r99097 on Windows 7 SP1 (x64).
12e3b974b7cb427087439bf5f922afb373bca8c3346525b183f6422b28801319
Druva inSync Windows Client version 6.5.2 suffers from a local privilege escalation vulnerability.
31dfb7b5bc6e0e8460608ac6efee03fdb1a7159259a19815bc7b9c3106a68129