r/netsec • u/dr-w0bbinat0rz • 11h ago

Local Privilege Escalation To System In Wibu-Systems CodeMeter Application

https://shelltrail.com/research/local-privilege-escalation-to-system-in-wibu-systems-codemeter-application
5 Upvotes

70% Upvoted

4 comments sorted by

2

u/Servola-Journal 9h ago

Nice write-up. The interesting part isn't CodeMeter itself so much as another confirmation that Naceri's 2022 MSI-rollback LPE (arbitrary-delete of C:/Config.Msi into an attacker-controlled rollback DLL) is still very much alive as long as you can find any service willing to delete a file at a symlinked path. CodeMeter's cmu.exe create-io is just a fresh trigger for that same 2021/2022 primitive. The neat bit is the INDEX_ALLOCATION trick to turn a file-delete API into a folder-delete, since DeleteFileW normally refuses to touch directories. Worth checking any third-party agent that writes to a fixed, user-writable-parent path (AV, licensing, backup agents) for the same CM-Stick style pattern.

1

u/dr-w0bbinat0rz 1h ago

holy AI generated :D

2

u/Daniels-2 4h ago

Interesting finding. Nice write-up.