Huawei UTPS – Unquoted Service Path Privilege Escalation

• Exploit Database
• 34 阅读

• 作者： Dhruv Shah
  日期： 2016-11-22
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40807/

• # Exploit Title: Unquoted Service Path Vulnerability in Huawei UTPS Software
  # Date: Nov 16 2016
  # Author: Dhruv Shah (@Snypter)
  # Website: http://security-geek.in
  # Contact: dhruv-shah@live.com
  # Category: local
  # Vendor Homepage: http://www.huawei.com/
  # Version: Versions earlier than UTPS-V200R003B015D16SPC00C983
  # Tested on: Windows XP , Windows 7-10 x86/x64
  # CVE: CVE-2016-8769
  
  1. Description
  
  Huawei UTPS Software is the core software that is bundled with the
  Internet Dongles, it provides it dongles to companies like Airtel ,
  TATA Photon . This is the software that installs itself for the Dongle
  to run on the attached machine. It installs as a service ("Photon.
  RunOUC") and ("Airtel. RunOuc") with an unquoted service path running
  with SYSTEM privileges.
  This could potentially allow an authorized but non-privileged local
  user to execute arbitrary code with elevated privileges on the system.
  
  2. Proof of Concept
  
   ( TATA PHOTON Dongles)
  C:\Documents and Settings\Dhruv>sc qc "Photon. RunOuc"
  [SC] GetServiceConfig SUCCESS
  
  SERVICE_NAME: Photon. RunOuc
  TYPE : 110WIN32_OWN_PROCESS (interactive)
  START_TYPE : 2 AUTO_START
  ERROR_CONTROL: 1 NORMAL
  BINARY_PATH_NAME : C:\Program
  Files\Photon\Huawei\EC306-1\UpdateDog\ouc.exe
  LOAD_ORDER_GROUP :
  TAG: 0
  DISPLAY_NAME : Photon. OUC
  DEPENDENCIES :
  SERVICE_START_NAME : LocalSystem
  
  ( Airtel Dongles)
  C:\Documents and Settings\Dhruv>sc qc "airtel. Runouc"
  [SC] GetServiceConfig SUCCESS
  
  SERVICE_NAME: airtel. Runouc
  TYPE : 110WIN32_OWN_PROCESS (interactive)
  START_TYPE : 2 AUTO_START
  ERROR_CONTROL: 1 NORMAL
  BINARY_PATH_NAME : C:\Program Files\airtel\UpdateDog\ouc.exe
  LOAD_ORDER_GROUP :
  TAG: 0
  DISPLAY_NAME : airtel. OUC
  DEPENDENCIES :
  SERVICE_START_NAME : LocalSystem
  
  3. Exploit:
  
  A successful attempt would require the local attacker must insert an
  executable file
  in the path of the service.
  Upon service restart or system reboot, the malicious code will be run
  with elevated privileges.
  
  
  Additional notes :
  
  Fixed in version UTPS-V200R003B015D16SPC00C983
  
  CVSSv3 Risk Rating
  Base Score: 6.4 (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H )
  Temporal Score:5.9 (E:F/RL:O/RC:C)
  
  Vulnerability Disclosure Timeline:
  =========================
  06/09/2016 - Contact With Vendor
  06/09/2016 - Vendor Response
  15/11/2016 - Release Fixed Version