CVE-2018-11479
HIGHWindscribe 1.81 - Unauthenticated Privilege Escalation via Named Pipe Command Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2018-11479.
PoCs published by Metasploit, Emin Ghuliev, bcoles, including Metasploit module exploits/windows/local/windscribe_windscribeservice_priv_esc.
AI-analyzed exploit summary This Metasploit module exploits a privilege escalation vulnerability in Windscribe VPN's named pipe service, allowing arbitrary command execution as SYSTEM. It writes a payload to a named pipe, which the service then executes with elevated privileges.
Description
The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that establishes a \\.\pipe\WindscribeService named pipe endpoint that allows the Windscribe VPN process to connect and execute an OpenVPN process or other processes (like taskkill, etc.). There is no validation of the program name before constructing the lpCommandLine argument for a CreateProcess call. An attacker can run any malicious process with SYSTEM privileges through this named pipe.
Exploits (2)
This Metasploit module exploits a privilege escalation vulnerability in Windscribe VPN's named pipe service, allowing arbitrary command execution as SYSTEM. It writes a payload to a named pipe, which the service then executes with elevated privileges.
This Metasploit module exploits a privilege escalation vulnerability in Windscribe VPN's Windows service by abusing an unvalidated named pipe to execute arbitrary commands as SYSTEM. It writes a payload to a named pipe, which the vulnerable service then executes with elevated privileges.
References (2)
Scores
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H