PoC Released for Unpatched Windows Vulnerability Present Since 2006

guest · Dec 11, 2020

PoC Released for Unpatched Windows Vulnerability Present Since 2006
...privilege escalation vulnerability in Windows related to the PsExec administration tool
December 11, 2020
https://www.securityweek.com/poc-released-unpatched-windows-vulnerability-present-2006

The vulnerability was discovered by Tenable researcher David Wells and it was disclosed this week after Microsoft failed to release a patch within 90 days.

Microsoft has not said when or if it will patch the vulnerability, but the tech giant pointed out that “this technique requires an attacker to have already compromised the target machine to run malicious code.”

“We encourage customers to practice good computing habits online, including exercising caution when clicking on links to web pages, opening unknown files, or accepting file transfers,” Microsoft told SecurityWeek in an emailed statement.
Click to expand...

While normally low-privileged users are not granted read/write access to this \PSEXESVC pipe, Wells discovered that an attacker can use a technique known as “pipe squatting” to achieve this goal.

If an attacker were to exploit the vulnerability, they would need to gain low-privileged access to the targeted system, deploy their malicious app, create a \PSEXESVC pipe, and wait for the targeted user to execute PsExec, either locally or remotely. This last requirement can make the security flaw less likely to be exploited in real world attacks.
Click to expand...

Wells has published a blog post containing technical details and a PoC exploit has been made available on GitHub.
Click to expand...

PsExec Local Privilege Escalation

So…this one’s been here for a while: a local privilege escalation vulnerability in PsExec.
This local privilege escalation allows a non-admin process to escalate to SYSTEM if PsExec is executed locally or remotely on the target machine. I was able to confirm this works from Windows 10 all the way back to XP and from my investigation, it affects PsExec v2.2 (latest as of this writing) all the way back to v1.72 (2006).

We gave Microsoft 90 days to patch the issue, however it has not been patched yet.
Click to expand...

Log in or Sign up

PoC Released for Unpatched Windows Vulnerability Present Since 2006

guest Guest

Log in or Sign up

PoC Released for Unpatched Windows Vulnerability Present Since 2006

guest Guest

Useful Searches