| عنوان | Iperius Iperius Backup <= 8.7.2 Incorrect Default Permissions |
|---|
| الوصف | Iperius Backup <= 8.7.2 allows local privilege escalation to NT AUTHORITY\SYSTEM via encrypted job file injection. The Iperius Backup Service runs under SYSTEM and automatically monitors the directory C:\ProgramData\IperiusBackup\Jobs for .ibj backup job configuration files. This directory has insecure default permissions granting BUILTIN\Users write access (WD,AD,WEA,WA), allowing any authenticated local user to create new files. The application encrypts commands stored in the PreCommand field using AES-128 in ECB mode, but the encryption key is deterministically derived from the system's MachineGuid registry value (HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid), which is readable by all local users. By reverse-engineering this encryption scheme, an attacker can craft a valid .ibj configuration file containing an encrypted arbitrary command in the PreCommand field and place it into the Jobs directory. The service will automatically load and execute the decrypted command under NT AUTHORITY\SYSTEM context, resulting in complete local privilege escalation without requiring GUI interaction or administrative privileges. |
|---|
| المصدر | ⚠️ https://github.com/VulnaraByte/iperius-backup-security-advisories |
|---|
| المستخدم | VulnaraByte (UID 96378) |
|---|
| ارسال | 12/03/2026 12:19 PM (7 أشهر منذ) |
|---|
| الاعتدال | 01/04/2026 02:02 PM (20 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 353124 [Enter Software Iperius Backup حتى 8.7.3 Backup Job Configuration File تجاوز الصلاحيات] |
|---|
| النقاط | 0 |
|---|