groovygasra.blogg.se

1. #Autodesk viewer software install#
2. #Autodesk viewer software software#
3. #Autodesk viewer software code#
4. #Autodesk viewer software windows#

For example, the following command can be used to identify services for which permissions have been assigned to the “Everyone” group: With the entire suite of tools available on the newly mounted “Z” drive, it is possible to enumerate all services and their permissions using the following command:įurther, if we know what local groups our account is a member of, we can zoom in on those services granting permissions directly to our account or groups of which we are a member.

Better yet, this tool can be run “live” without ever requiring the executable itself to touch disk on a target system, thanks to the live versions of these tools available over the internet.Ī command like the following can allow an attacker or penetration tester to mount and use the entire SysInternals suite of tools, without requiring any actual downloads:

#Autodesk viewer software code#

These include the fact that this executable is signed by Microsoft, meaning it’s very unlikely to be flagged by antivirus vendors as potentially malicious, and may even bypass certain application whitelisting restrictions which require code to be signed by authorized developers in order to run on an endpoint. As well as being able to identify various types of service configuration weaknesses, this tool also provides additional benefits over some of the other offerings.

#Autodesk viewer software windows#

One of the best tools available is accesschk, which is part of the Windows SysInternals Suite. Vulnerabilities related to insecure service configurations are nothing new in the world of information security, and as such, there are a number of offensive and defensive tools available to identify and exploit this class of vulnerabilities. This account requires local system access, meaning an attacker would first have to gain initial access to a system, prior to being able to escalate their privileges using this vulnerability.

#Autodesk viewer software install#

As a result, an attacker could then install programs view, change, or delete data or create new accounts with full user rights. This means that any low privileged user can abuse this vulnerable service configuration to execute code in the context of a highly privileged account, resulting in local privilege escalation. The default privileges assigned to this service allow any authenticated user to modify the service configuration. The issue lies in the default permissions assigned to the Autodesk Licensing Service which runs as a locally privileged operating system account.

#Autodesk viewer software software#

Additionally, Autodesk software is widely deployed across the defense industrial base and critical infrastructure sectors. Organizations all over the world rely on Autodesk products, including AutoCAD, to aid in the design, development, and manufacturing of all kinds of products. While a vulnerability in any one Autodesk product represents a risk to the organizations which happen to be using that specific piece of software, a vulnerability that affects nearly all Autodesk applications is considered a critical issue requiring immediate attention.Īutodesk is a global leader in 3D design and development software, and their products are ubiquitous across many industry verticals, including architecture, engineering, construction, design, and manufacturing. The Common Vulnerabilities and Exposures number is CVE-2021-27032, Autodesk Licensing Service: Local Privilege Escalation.īecause these software products are so widely deployed across the public and private sectors, vulnerabilities in Autodesk products pose a significant risk to many organizations, as Autodesk products are often used to generate and process intellectual property and other sensitive data. The vulnerability exists in a software component common to most Autodesk products and impacts nearly all organizations using licensed Autodesk software in any capacity. During a recent client engagement, the DGC (DiCicco, Gulman & Company) penetration testing team identified a previously unknown vulnerability affecting the Autodesk Licensing Service, a software component bundled with nearly all licensed Autodesk products.