It is part of Plantronics HUB and runs as “ NT_AUTHORITY\SYSTEM”. Their software, Plantronics HUB, allows the end users to customize the settings and view the status of the audio devices plugged in a system.Īfter its installation a new service called “ SpokesUpdateService.exe” shows up in the system. Poly (annual revenue 1,2 USD billion) is the company behind the Plantronics brand producing audio devices for the segments business and consumer. One of such applications was Plantronics HUB.
Amongst the various applications, there were some whose installation could be started by an unprivileged user but, at the end of this process, showed at least one component running in privileged mode. However, after a quick check, we noticed that all software distributed through SCCM came with the latest versions available.
PLANTRONICS HUB VERSION INSTALL
Like most of the other systems in the network, in this compromised machine a low privileged user could install software on-demand via Microsoft System Center Configuration Manager. After wandering around the LAN for a while, we got stuck inside a machine where we could see a domain admin who had an open session there (Bloodhound’s power), but our low privileges did not allow to dump the LSASS’s memory to retrieve the credentials and play our usual (in these cases) impersonation tricks. During a recent Red Team operation we have been asked to attempt the takeover of a domain controller server in a Windows network.
0 kommentar(er)
