Microsoft has fixed a vulnerability in the PsExec utility that allows local users to gain elevated privileges on Windows devices.
PsExec is a Sysinternals utility designed to allow administrators to perform various activities on remote computers, such as launching executables and displaying the output on the local computer or creating reverse shells.
Due to the tool’s versatility, threat actors commonly use PsExec in their post-exploitation toolkits to spread laterally to other machines on a network, execute commands on a large number of devices simultaneously, or deploy malware such as ransomware..
In December 2020, Tenable researcher David Wells discovered a vulnerability in the PsExec’s named pipe communications that allow local users to elevate to SYSTEM privileges.
“This local privilege escalation allows a non-admin process to escalate to SYSTEM if PsExec is executed locally or remotely on the target machine. I was able to confirm this works from Windows 10 all the way back to XP and from my investigation, it affects PsExec v2.2 (latest as of this writing) all the way back to v1.72 (2006),” explained Wells.
After reporting the vulnerability, Wells gave Microsoft ninety days to fix the vulnerability, and when Microsoft did not fix it, disclosed the flaw and released a full working PoC.
Microsoft releases fix for PsExec vulnerability
After the vulnerability was publicly disclosed, Microsoft released PsExec version 2.30 to resolve the vulnerability. However, Wells stated that minor adjustments to his PoC could bypass the fix.
“There has been new PsExec versions released in 2021 (v2.30 and v2.32), we confirmed them to also be vulnerable to this Local Privilege Escalation with minor PoC adjustments,” Wells warned.
Yesterday, Microsoft released PsExec v2.33, which includes a new fix for the named pipe local privilege elevation vulnerability.
“This update to PsExec mitigates named pipe squatting attacks that can be leveraged by an attacker to intercept credentials or elevate to System privilege. the -i command line switch is now necessary for running processes interactively, for example with redirected IO,” reads the PsExec v2.33 release notes.
Tenable has confirmed with BleepingComputer that this release has fixed the vulnerability.
To read the original article: