# CVE-2024-54910
This document explores a vulnerability that allows arbitrary file writes, leading to
privilege escalation on a Windows System that has Hasleo Backup Suite Free 4.9.4
installed. It demonstrates how backup recovery operations, combined with
symbolic links and low-privileged user operations, can overwrite critical system
Files or place malicious executables in sensitive directories, enabling attackers to
gain administrative access. The methodology is divided into two phases: exploiting
the file write vulnerability and escalating privileges by placing a malicious payload
in the Windows startup folder.
Afected Version: Hasleo Backup Suite Free 4.9.4
Host specifications: Microsoft Windows 10 Pro 64-bit 10.0.19045
Arbitrary File Write
Testing file permissions when recovering a backup, I spotted that the file goes with admin privileges to wherever we specify, creating the full path to the file, as C+\therestofthepath.
We will develop every step as a low privileged user.
Steps To reproduce:
- First, we create the file in C:\Temp
- Afterwards, we create a new backup from this file as the “little” user. We place the file in C:\Temp also, but it doesn’t really matter.
- Now, we are creating a symbolic link in an empty folder we have created, in C:\, as we don’t have to be admin to create folders in C:\ . The folder will be C:\C+
- We open the symlink: C:\SymbolicLinks\CreateSumlink.exe C:\C+\Temp\Copyme.txt C:\Windows\Copyme.txt
- Now, we want to recover the backup we made, We select the file we want to write on C:\Windows and change the output path to C:\ (Before clicking the button, lets create as admin a Copyme.txt file with the contents “I’m not vulnerable” in C:\Windows )
- Afterwards, we click the next button, We have now successfully overwritten the file we created as administrator
In order to escalate our privileges, we could for example place an executable in the startup windows folder:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasleo Backup Suite>C:\SymbolicLinks\CreateSymlink.exe C:\C+\Temp\pwned.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FULLPWN.exe"
Opened Link \RPC Control\pwned.exe -> \??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FULLPWN.exe: 00000138
Press ENTER to exit and delete the symlink
[4.0K] /data/pocs/5e63675ab3073f0b9aa2a8cb47cf16d987557e8d
└── [2.3K] README.md
0 directories, 1 file