DCOM Privilege Escalation

vendor:

Windows

by:

Unknown

7.2

CVSS

HIGH

Privilege Escalation

269

CWE

Product Name: Windows

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE: Unknown

CPE: o:microsoft:windows

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

A local user can modify DCOM registry entries to escalate their privilege level. By editing the registry keys associated with DCOM server applications, they can change which services are started to handle specific events. By overwriting the services EXE file and triggering the event, the user's code can run as SYSTEM.

Mitigation:

Limit user access to DCOM registry entries and ensure proper permissions are set to prevent unauthorized modification. Regularly update and patch the affected software.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/624/info


It is possible for a local user to modify how DCOM servers are run, thereby escalating his/her privilege level. The Interactive User has write permissions to the DCOM registry entries. By editing the registry keys associated with DCOM server applications, they can change which services are started to handle specific events. They can then overwrite the services EXE file, trigger the event, and have their code run as SYSTEM. 


This exploit will cause the System Event Notification service or SENS service to start when a VBScript calls for the creation of a new Wordpad Document. The SENS service is installed during an installation of IE5, but is not started. The default permissions allow Everybody write access to the EXE.
Edit the
HKCR\AppID\{73FDDC80-AEA9-101A-98A7-00AA00374959}
registry key and add a new value, "LocalService", with data SENS

Create an HTML document, with the following VBScript in it:
<SCRIPT LANGUAGE="VBScript"> CreateObject("Wordpad.Document.1") </SCRIPT>

Open the html document in a browser. The browser will request that the COM Service Control Manager (RPCSS.EXE) start the service associated with Wordpad.