Relative Path Traversal Leading to SYSTEM Command Execution in Druva inSync Windows Client 6.6.3

Repository contains a minimal C proof-of-exploit for CVE-2020-5752 (Druva inSync Windows Client <= 6.6.3) local privilege escalation. Structure: - README.md: Describes the vulnerability (RPC service on TCP/6064 vulnerable to command injection via path traversal), compilation with MinGW (links ws2_32), and usage requiring nc.exe plus an attacker listener. - exploit.c: Windows C program using Winsock to connect to the local service at 127.0.0.1:6064, send a fixed protocol header ("inSync PHC RPCW[v0002]") and an RPC type (0x05 00 00 00), then send a length-prefixed UTF-16LE command string. Exploit behavior/capabilities: - Delivers a crafted RPC request that leverages path traversal to invoke Windows\System32\cmd.exe from a Druva-controlled path (C:\ProgramData\Druva\inSync4\..\..\..\..\..\..\Windows\System32\cmd.exe). - Executes a command as NT AUTHORITY\\SYSTEM. The hardcoded command uses user-supplied parameters to run netcat (NC_PATH) to connect back to LHOST:LPORT and spawn an interactive SYSTEM shell ("-e cmd.exe"). Targeting/IOCs: - Local network endpoint: 127.0.0.1:6064 (Druva inSync RPC service). - Executed binary path via traversal: ...\Windows\System32\cmd.exe. - Typical payload dependency: nc.exe placed in a SYSTEM-accessible directory (example: C:\Windows\Tasks\nc.exe). Overall, this is an operational local LPE exploit (not just detection) with a basic, hardcoded reverse-shell payload pattern driven by command-line arguments.

This repository contains a single Metasploit module targeting a local privilege escalation vulnerability in the Druva inSync client for Windows (CVE-2019-3999 and CVE-2020-5752). The exploit abuses an RPC service (inSyncCPHwnet64.exe) listening on TCP port 6064 on the local interface. By sending a specially crafted RPC type 5 message with a user-controlled program path, the attacker can execute arbitrary commands as SYSTEM. The module writes a payload executable (default: Meterpreter reverse shell) to a writable directory (default: %TEMP%), then triggers its execution via the vulnerable service. The exploit is operational and provides SYSTEM-level access if successful. The code is written in Ruby and is structured as a standard Metasploit local exploit module, with all logic contained in a single file.

This repository contains a PowerShell exploit (DruvaPE.ps1) targeting a local privilege escalation vulnerability (CVE-2020-5752) in Druva inSync Windows Client version 6.6.3. The exploit leverages a vulnerable RPC service to inject and execute arbitrary commands as SYSTEM by sending a specially crafted payload to a local socket (127.0.0.1:6064). The main payload downloads and executes a PowerShell reverse shell from an attacker-controlled server (http://10.10.14.4:8080/shell.ps1), then connects back to the attacker's machine (10.10.14.3:9443) with elevated privileges. The repository consists of the exploit script and a brief README. The exploit is operational and provides a working reverse shell, but requires the attacker to modify IP addresses and host a payload. No detection scripts or framework integration are present.