CVE-2022-38532 PoC — Micro-Star International MSI Center 安全漏洞

Source

https://github.com/nam3lum/msi-central_privesc

Associated Vulnerability

Title:Micro-Star International MSI Center 安全漏洞 (CVE-2022-38532)
Description:Micro-Star International MSI Center是中国微星科技（Micro-Star International）公司的一个监控管理平台。可以在功能集页面中找到所有您喜欢的功能，例如游戏模式或智能优先。 Micro-Star International MSI Center 1.0.50.0版本存在安全漏洞，该漏洞源于其MSI.CentralServer.exe的C_Features组件允许攻击者通过运行精心制作的可执行文件来升级权限。

Description

CVE-2022-38532 - Local Privilege Escalation vulnerability in MSI Center Application

Readme

# CVE-2022-38532

### Local privilege escalation in MSI Center desktop application.

![CVE-2022-38532](https://github.com/nam3lum/msi-central_privesc/raw/main/media/MSI%20Center.png)

The vulnerability exist in "C_Features" of MSI.CentralServer.exe. MSI.CentralServer.exe is an application that gathers information about your system, it collaborates with MSI.TerminalServer.exe. The ExecuteTask function which we can call it in "CMD_AutoUpdateSDK" gives us a chance to run an exectable with custom parameters under Administrative privileges. You can see the related port only from localhost. 

![Vulnerable process & port](https://github.com/nam3lum/msi-central_privesc/raw/main/media/MSI.CS-ps.jpg)

#### The vulnerability
You can easily disassemble the MSI.CentralServer.exe using any .NET disassembler. Central Server itself listens on 32682 port from localhost, we can find the source code of the handler in "C_Features". Just look at the CMD_AutoUpdateSDK feature to see the vulnerability. We abuse this feature (it is automatic updater of MSI Center). It receives the user-given payload, splits it into multiple parts to execute the command with custom parameters.
![Vulnerable feature](https://github.com/nam3lum/msi-central_privesc/raw/main/media/Vulnerable%20function.png)

This is main function which our feature uses it to execute given PE with custom arguments:
![Main function](https://github.com/nam3lum/msi-central_privesc/raw/main/media/Main%20function.png)

### The port which MSI Central Server listens is updated in 1.0.59.0 version. It is 32683.

#### POC
You can generate your own payload, hex it and run the script in the local computer. The POC creates hacker user with "hacker123" password and adds it to the Administrators group.

**Proof-of-Concept video:**
https://user-images.githubusercontent.com/64528432/188067866-f30fe089-db76-4cc0-81ce-f74871769b33.mp4

File Snapshot


 [4.0K]  /data/pocs/aee73a67dd9374cd297e58a8352ab6253aecb437
├── [1015]  exploit.py
├── [4.0K]  media
│   ├── [ 25K]  Main function.png
│   ├── [239K]  MSI Center.png
│   ├── [ 24K]  MSI.CS-ps.jpg
│   ├── [ 21M]  PoC-video.mp4
│   └── [230K]  Vulnerable function.png
├── [6.3M]  msic_privesc.exe
└── [1.8K]  README.md

1 directory, 8 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!