Migration of the meterpreter process is the solution to prevent the Windows service timeout to close the injected scsiaccess.exe. Now you’re SYSTEM on Windows 8 Enterprise. All you need is to prepare a meterpreter handler which will catch the connection from the hijacked service …and after a simple system restart (or service restart): The attacker is able to replace (rename and copy new file) the scsiaccess.exe, which makes it easy to escalate the privileges here since Windows allows you to do so :-). This requires the attacker to already have access to the victim system. Let’s create a reverse meterpreter shell scsiaccess.exe: Save time and speed-up your workflow with Producers built-in wizard. Turn your photos, videos and music into totally custom, professional video slideshows for clients, friends and family. The file permissions of the scsiaccess.exe file which belongs to the service are weak:Įveryone: (I)(F) means Inherited Full Access. ProShow Producer is the highly anticipated professional presentation software that joins ease of use, enhanced workflow, and unmatched speed.

Sounds painful…and there’s currently no painkiller (patch) available.īy default the application installs a service called “ScsiAccess” running under the local SYSTEM account, which requires a reboot upon installation. Which will be executed by a victim user or after a ScsiAccess service To replace the original application binary with a malicious application A local attacker or compromised process is able SYSTEM account, may allow a less privileged user to gain access to Which is used by the application service 'ScsiAccess' under the

Quoted from my published advisory: Insecure file permissions on the executable file 'scsiaccess.exe', OK…honestly… I promise (!)… this is the last advisory about the ProShow Producer application, but also the most dangerous one with a CVSS Score of 7,2 and exploitable on at least all english Microsoft Windows based operating systems!

Proshow producer 6 patch