[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Native Instruments Service Center 2.2.5 Local Privilege Escalation Vulnerability
# Published : 2010-11-20
# Author : LiquidWorm
# Previous Title : Free CD to MP3 Converter 3.1 Buffer Overflow Exploit (Bypass DEP + SEH)
# Next Title : Windows Task Scheduler Privilege Escalation 0day
Native Instruments Service Center 2.2.5 Local Privilege Escalation Vulnerability
Vendor: Native Instruments GmbH
Product web page: http://www.native-instruments.com
Affected version: 2.2.5 (R596)
Summary: The NI Service Center is a service used for Product Activation.
Desc: The Native Instruments's Service Center suffers from an elevation of
privileges vulnerability which can be used by a simple user that can change
the executable file with a binary of choice. The vulnerability exist due to
the improper permissions, with the "C" flag (Change(write)) for "Everyone",
for the installed files ServiceCenter.exe and Reloader.exe.
Tested on: Microsoft Windows XP Professional SP3 (English)
Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab - http://www.zeroscience.mk
Advisory ID: ZSL-2010-4981
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4981.php
06.11.2010
PoC:
----------------------------------------------------------------------------
C:Program FilesNative InstrumentsService Center>dir
Volume in drive C has no label.
Volume Serial Number is 7C64-FE80
Directory of C:Program FilesNative InstrumentsService Center
07.11.2010 19:52 <DIR> .
07.11.2010 19:52 <DIR> ..
05.11.2010 17:58 <DIR> conf
05.11.2010 17:58 <DIR> Documentation
05.11.2010 17:57 738.632 Reloader.exe
05.11.2010 17:58 10.650.440 ServiceCenter.exe
2 File(s) 11.389.072 bytes
4 Dir(s) 9.880.768.512 bytes free
C:Program FilesNative InstrumentsService Center>cacls ServiceCenter.exe
C:Program FilesNative InstrumentsService CenterServiceCenter.exe BUILTINAdministrators:F
Everyone:C
NT AUTHORITYSYSTEM:F
C:Program FilesNative InstrumentsService Center>cacls Reloader.exe
C:Program FilesNative InstrumentsService CenterReloader.exe BUILTINAdministrators:F
Everyone:C
NT AUTHORITYSYSTEM:F
C:Program FilesNative InstrumentsService Center>
----------------------------------------------------------------------------