UPnPHostFileRead

KO | EN

gitlite — search

#javascript #typescript #llm #golang #machine-learning #linux #java #awesome #kubernetes #vue #security #pytorch #ios #openai

UPnPHostFileRead

(★ 20)

Arbitrary file read exploit for the Windows UPnP Device Host service.

UPnPHostFileRead 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Description
Local arbitrary file read PoC exploit for the Windows UPnP Device Host service. Reads an arbitrary file in the context of `LOCAL SERVICE`. Tested against Windows 11 Pro build 26200.8457.

Reported to Microsoft. Assessed as "not a vulnerability".

# How to Build
1. Clone the repository.
2. Build the UPnPHostFileRead solution.

# How to Use
- Run `UPnPHostFileRead.exe SOURCE DESTINATION`.

The `SOURCE` file will be read in the context of `LOCAL SERVICE` and will then be written to `DESTINATION` in the context of the current user.

![Screenshot](https://raw.githubusercontent.com/SpacePlant/UPnPHostFileRead/master/poc_1.png)
![Screenshot](https://raw.githubusercontent.com/SpacePlant/UPnPHostFileRead/master/poc_2.png)

# Technical Details
Normal users can create an instance of the `UPnPRegistrar` COM object and call the `RegisterRunningDevice` method, which will register a device with a device description XML. This XML can reference an icon, but the reference is vulnerable to path traversal and can be pointed to any file on the system. After registering the device, the referenced file is then exposed by an HTTP service running as `LOCAL SERVICE` and anyone can access the endpoint and download the file.

UPnPHostFileRead

UPnPHostFileRead 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

UPnPHostFileRead

UPnPHostFileRead 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README