Privilege escalation in Linksys WLAN Monitor v2.0
Privilege escalation in Linksys WLAN Monitor v2.0 (http://www.linksys.com/)
Details:
The Linksys WLAN Monitor service (WLSVC) that is used to configure
settings for various Linksys wireless network cards runs under the
context of the LocalSystem account. It is possible to manipulate the
administrative interface of the Linksys WLAN Monitor and escalate
privileges to that of the LocalSystem account.
Vulnerable Versions:
Linksys WLAN Monitor v2.0 (for the WUSB54G wireless NIC and possibly
other wireless NICs)
Patches/Workarounds:
The vendor was notified of the issue. There was no response as to
whether or not a patch/fix would be released.
Exploits:
1. Right click on the Linksys Wireless Network Monitor in the lower right corner
of the screen and click Open the Monitor.
2. Click the Profiles tab and click Import.
2. Right click on the Open button and click What's This?
3. Right click on the help text that is shown in yellow and click Print Topic.
4. Right click on any printer and click Open.
5. Click Help, Help Topics.
6. Right click in the right side of the help screen and click View Source.
7. Notepad will appear (running under the context of the LocalSystem account).
Click File, click Open.
8. Change Files of type: to All Files, navigate to the system32 directory and
locate cmd.exe. Right click cmd.exe and choose Open.
The result is a command prompt running under the context of the LocalSystem
account.
Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)