NMAP 7.12- DLL Hijacking Privilege Escalation.

[Nitesh Shilpkar <shilpkar.nitesh () gmail com>]

NMAP setup for windows suffers from a DLL hijacking privilege escalation
vulnerability.

The "NMAP" loads and executes dll from its "application directory".

For software downloaded with a web browser the application directory is
typically the user's "Downloads" directory: see <
https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html>,<

http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html>
and <http://seclists.org/fulldisclosure/2012/Aug/134> for "prior art" about
this well-known and well-documented vulnerability.


If an attacker places malicious DLL in the user's "Downloads" directory
(for example per "drive-by download" or "social engineering") this
vulnerability becomes a remote code execution.


Proof of concept/demonstration:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1. Create a malicious dll file and save it to your "Downloads" directory in
a GUEST account.
2. Download the latest NMAP version 7.1.2.
3. Click on the Windows NMAP setup for windows..
4. UAC settings would ask for a password, as the victim supplies with the
password to run the setup.

5. A remote shell with Administrative privileges is opened.

Thanks and Regards,

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/