0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Native Instruments Service Center 2.2.5 Local Privilege Escalation
[==================================================================
Native Instruments Service Center 2.2.5 Local Privilege Escalation
==================================================================
Vendor: Native Instruments GmbH
Product web page: http://www.native-instruments.com
Affected version: 2.2.5 (R596)
Summary: The NI Service Center is a service used for Product Activation.
Desc: The Native Instruments's Service Center suffers from an elevation of
privileges vulnerability which can be used by a simple user that can change
the executable file with a binary of choice. The vulnerability exist due to
the improper permissions, with the "C" flag (Change(write)) for "Everyone",
for the installed files ServiceCenter.exe and Reloader.exe.
Tested on: Microsoft Windows XP Professional SP3 (English)
Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Zero Science Lab - http://www.zeroscience.mk
Advisory ID: ZSL-2010-4981
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4981.php
06.11.2010
PoC:
----------------------------------------------------------------------------
C:\Program Files\Native Instruments\Service Center>dir
Volume in drive C has no label.
Volume Serial Number is 7C64-FE80
Directory of C:\Program Files\Native Instruments\Service Center
07.11.2010 19:52 <DIR> .
07.11.2010 19:52 <DIR> ..
05.11.2010 17:58 <DIR> conf
05.11.2010 17:58 <DIR> Documentation
05.11.2010 17:57 738.632 Reloader.exe
05.11.2010 17:58 10.650.440 ServiceCenter.exe
2 File(s) 11.389.072 bytes
4 Dir(s) 9.880.768.512 bytes free
C:\Program Files\Native Instruments\Service Center>cacls ServiceCenter.exe
C:\Program Files\Native Instruments\Service Center\ServiceCenter.exe BUILTIN\Administrators:F
Everyone:C
NT AUTHORITY\SYSTEM:F
C:\Program Files\Native Instruments\Service Center>cacls Reloader.exe
C:\Program Files\Native Instruments\Service Center\Reloader.exe BUILTIN\Administrators:F
Everyone:C
NT AUTHORITY\SYSTEM:F
C:\Program Files\Native Instruments\Service Center>
----------------------------------------------------------------------------
# 0day.today [2024-12-28] #