CVE-2024-54910

https://www.cve.org/CVERecord?id=CVE-2024-54910

This document explores a vulnerability that allows arbitrary file writes, leading to privilege escalation on a Windows System that has Hasleo Backup Suite Free <= 4.9.4 installed. It demonstrates how backup recovery operations, combined with symbolic links and low-privileged user operations, can overwrite critical system

Files or place malicious executables in sensitive directories, enabling attackers to gain administrative access. The methodology is divided into two phases: exploiting the file write vulnerability and escalating privileges by placing a malicious payload in the Windows startup folder.

Afected Version: Hasleo Backup Suite Free <= 4.9.4

Host specifications: Microsoft Windows 10 Pro 64-bit 10.0.19045

Arbitrary File Write Testing file permissions when recovering a backup, I spotted that the file goes with admin privileges to wherever we specify, creating the full path to the file, as C+\therestofthepath. We will develop every step as a low privileged user.

Steps To reproduce:

• First, we create the file in C:\Temp
• Afterwards, we create a new backup from this file as the “little” user. We place the file in C:\Temp also, but it doesn’t really matter.
• Now, we are creating a symbolic link in an empty folder we have created, in C:, as we don’t have to be admin to create folders in C:\ . The folder will be C:\C+
• We open the symlink: C:\SymbolicLinks\CreateSumlink.exe C:\C+\Temp\Copyme.txt C:\Windows\Copyme.txt
• Now, we want to recover the backup we made, We select the file we want to write on C:\Windows and change the output path to C:\ (Before clicking the button, lets create as admin a Copyme.txt file with the contents “I’m not vulnerable” in C:\Windows )
• Afterwards, we click the next button, We have now successfully overwritten the file we created as administrator

In order to escalate our privileges, we could for example place an executable in the startup windows folder:

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo Backup Suite>C:\SymbolicLinks\CreateSymlink.exe C:\C+\Temp\pwned.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FULLPWN.exe"

Opened Link \RPC Control\pwned.exe -> ??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FULLPWN.exe: 00000138 Press ENTER to exit and delete the symlink