Scribd Logo
Upload

Welcome to Scribd!

  • Wondershare Priv Esc

    Uploaded by

    scribdfoo1
    109 views1 page
    Wondershare Dr Fone version 12.9.6 has a local privilege escalation vulnerability that allows standard users to elevate privileges to administrator. The "WsDrvInst" service runs with system permissions and its executable, DriverInstall.exe, allows any authenticated user to modify it. By modifying this executable, a standard user can exploit this vulnerability to gain administrator privileges on affected systems.

    Original Description:

    Original Title

    wondershare-priv-esc

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    Wondershare Dr Fone version 12.9.6 has a local privilege escalation vulnerability that allows standard users to elevate privileges to administrator. The "WsDrvInst" service runs with system permissions and its executable, DriverInstall.exe, allows any authenticated user to modify it. By modifying this executable, a standard user can exploit this vulnerability to gain administrator privileges on affected systems.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    109 views1 page

    Wondershare Priv Esc

    Uploaded by

    scribdfoo1
    Wondershare Dr Fone version 12.9.6 has a local privilege escalation vulnerability that allows standard users to elevate privileges to administrator. The "WsDrvInst" service runs with system permissions and its executable, DriverInstall.exe, allows any authenticated user to modify it. By modifying this executable, a standard user can exploit this vulnerability to gain administrator privileges on affected systems.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 1

    # Exploit Title: Wondershare Dr Fone 12.9.

    6 - Privilege Escalation
    # Date: 14 March 2023
    # Exploit Author: Thurein Soe
    # Vendor Homepage: https://drfone.wondershare.com
    # Software Link: https://mega.nz/file/ZFd1TZIR#e2WfCX_ryaH08C3VNGZH1yAIG6DU01p-
    M_rDooq529I
    # Version: Dr Fone version 12.9.6
    # Tested on: Window 10 (10.0.19045.2604)
    # CVE : CVE-2023-27010

    *Vulnerability description*:

    Wondershare Dr Fone version 12.9.6 running services named "WsDrvInst" on


    Windows have weak service permissions and are susceptible to local
    privilege escalation vulnerability. Weak service permissions run with
    system user permission, allowing a standard user/domain user to elevate to
    administrator privilege upon successfully modifying the service or
    replacing the affected executable. DriverInstall.exe gave modification
    permission to any authenticated users in the windows operating system,
    allowing standard users to modify the service and leading to Privilege
    Escalation.

    C:\Users\NyaMeeEain\Desktop>cacls "C:\Program Files


    (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
    C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe

    Everyone:(ID)F

    NT AUTHORITY\SYSTEM:(ID)F

    BUILTIN\Administrators:(ID)F

    BUILTIN\Users:(ID)R

    APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R

    APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R


    C:\Users\NyaMeeEain\Desktop>sc qc WsDrvInst
    SERVICE_NAME: WsDrvInst
    TYPE : 10 WIN32_OWN_PROCESS
    START_TYPE : 3 DEMAND_START
    ERROR_CONTROL : 1 NORMAL
    BINARY_PATH_NAME : "C:\Program Files
    (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
    LOAD_ORDER_GROUP :
    TAG : 0
    DISPLAY_NAME : Wondershare Driver Install Service
    DEPENDENCIES : RPCSS
    SERVICE_START_NAME : LocalSystem

    You might also like