来源

关联漏洞

介绍

# CVE-2024-54910
This document explores a vulnerability that allows arbitrary file writes, leading to 
privilege escalation on a Windows System that has Hasleo Backup Suite Free 4.9.4 
installed. It demonstrates how backup recovery operations, combined with 
symbolic links and low-privileged user operations, can overwrite critical system 

Files or place malicious executables in sensitive directories, enabling attackers to 
gain administrative access. The methodology is divided into two phases: exploiting 
the file write vulnerability and escalating privileges by placing a malicious payload 
in the Windows startup folder. 

Afected Version: Hasleo Backup Suite Free 4.9.4 

Host specifications: Microsoft Windows 10 Pro  64-bit  10.0.19045

Arbitrary File Write 
Testing file permissions when recovering a backup, I spotted that the file goes with admin privileges to wherever we specify, creating the full path to the file, as C+\therestofthepath. 
We will develop every step as a low privileged user.

Steps To reproduce:
- First, we create the file in C:\Temp 
- Afterwards, we create a new backup from this file as the “little” user. We place the file in C:\Temp also, but it doesn’t really matter.
- Now, we are creating a symbolic link in an empty folder we have created, in C:\, as we don’t have to be admin to create folders in C:\ . The folder will be C:\C+
- We open the symlink: C:\SymbolicLinks\CreateSumlink.exe C:\C+\Temp\Copyme.txt C:\Windows\Copyme.txt
- Now, we want to recover the backup we made, We select the file we want to write on C:\Windows and change the output path to C:\ (Before clicking the button, lets create as admin a Copyme.txt file with the contents “I’m not vulnerable” in C:\Windows )
- Afterwards, we click the next button, We have now successfully overwritten the file we created as administrator 

In order to escalate our privileges, we could for example place an executable in the startup windows folder:

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo Backup Suite>C:\SymbolicLinks\CreateSymlink.exe C:\C+\Temp\pwned.exe 
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FULLPWN.exe" 

Opened Link \RPC Control\pwned.exe -> \??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FULLPWN.exe: 00000138 
Press ENTER to exit and delete the symlink 

文件快照

 [4.0K]  /data/pocs/5e63675ab3073f0b9aa2a8cb47cf16d987557e8d
└── [2.3K]  README.md

0 directories, 1 file

备注