POC详情: 5e63675ab3073f0b9aa2a8cb47cf16d987557e8d

来源
关联漏洞
标题: Hasleo Backup Suite Free 安全漏洞 (CVE-2024-54910)
描述:Hasleo Backup Suite Free(EasyUEFI Backup Suite Free)是Hasleo公司的一款完全免费的 Windows 备份软件。 Hasleo Backup Suite Free v4.9.4及之前版本存在安全漏洞,该漏洞源于通过文件恢复功能容易受到不安全权限的攻击。
介绍
# CVE-2024-54910
This document explores a vulnerability that allows arbitrary file writes, leading to 
privilege escalation on a Windows System that has Hasleo Backup Suite Free 4.9.4 
installed. It demonstrates how backup recovery operations, combined with 
symbolic links and low-privileged user operations, can overwrite critical system 

Files or place malicious executables in sensitive directories, enabling attackers to 
gain administrative access. The methodology is divided into two phases: exploiting 
the file write vulnerability and escalating privileges by placing a malicious payload 
in the Windows startup folder. 

Afected Version: Hasleo Backup Suite Free 4.9.4 

Host specifications: Microsoft Windows 10 Pro  64-bit  10.0.19045

Arbitrary File Write 
Testing file permissions when recovering a backup, I spotted that the file goes with admin privileges to wherever we specify, creating the full path to the file, as C+\therestofthepath. 
We will develop every step as a low privileged user.

Steps To reproduce:
- First, we create the file in C:\Temp 
- Afterwards, we create a new backup from this file as the “little” user. We place the file in C:\Temp also, but it doesn’t really matter.
- Now, we are creating a symbolic link in an empty folder we have created, in C:\, as we don’t have to be admin to create folders in C:\ . The folder will be C:\C+
- We open the symlink: C:\SymbolicLinks\CreateSumlink.exe C:\C+\Temp\Copyme.txt C:\Windows\Copyme.txt
- Now, we want to recover the backup we made, We select the file we want to write on C:\Windows and change the output path to C:\ (Before clicking the button, lets create as admin a Copyme.txt file with the contents “I’m not vulnerable” in C:\Windows )
- Afterwards, we click the next button, We have now successfully overwritten the file we created as administrator 

In order to escalate our privileges, we could for example place an executable in the startup windows folder:

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo Backup Suite>C:\SymbolicLinks\CreateSymlink.exe C:\C+\Temp\pwned.exe 
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FULLPWN.exe" 

Opened Link \RPC Control\pwned.exe -> \??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FULLPWN.exe: 00000138 
Press ENTER to exit and delete the symlink 
文件快照

[4.0K] /data/pocs/5e63675ab3073f0b9aa2a8cb47cf16d987557e8d └── [2.3K] README.md 0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。