Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MSI Center – How to gain SYSTEM privileges in seconds

mrbruh.com

Post reply on HN
Print view View original

31–40 of 68 posts

Re: MSI Center – How to gain SYSTEM privileges in seconds

#31

Post by rock_artist »

No directly related to danger of MSI Center after years of suffering I've removed it.

As my work develop is focused on macOS and Windows apps, I need a Windows laptop and got a light Prestige 13 inch with 32GB and 125H.

It did the trick, but I had years of not understanding how the throttling works. Sometimes if I was using AC and battery was lower than 90% I had CPU throttled at 800Mhz or even 400Mhz never going over 1Ghz. it drove me nuts and my fiddling with MSI Center was always unexpected. I had some strange steps to like connect/disconnect charger, change MSI Center performance settings. none was reliable. (even with Windows Power Settings all the way to max)

Eventually I've found on a reddit thread this (strangely hidden) uninstaller: https://www.msi.com/faq/9934 https://download.msi.com/uti_exe/nb/CleanCenterMaster.zip

Leaving the throttling and fan to Microsoft + Intel seems to do much better work. I no longer look at the task manager for CPU frequency. it just works.

So I have no clue what are the advantages of MSI Center in the first place (maybe bios updating?)

Re: MSI Center – How to gain SYSTEM privileges in seconds

#32

Post by jath03 »

matheusmoreira wrote: post #8
nzeid wrote: post #4

> After this minor hiccup, the experience with MSI was actually quite pleasant. They prepared a patch for the vulnerability within two days of me reporting it and told me which MSI Center release it was to be bundled with, and when they planned to release the new version. Was NOT expecting a happy ending. I don't know if the part of MSI Center with the pipe vulnerability is automatically installed on desktops but thi…

> this is the terribly written software that you need to turn off all the obnoxious lights on your MB and DRAM You should reverse engineer it and write a free software replacement! I did this for my Clevo laptop's keyboard LEDs: https://github.com/matheusmoreira/ite-829x Still one of my most satisfying projects and I use it to this day. These manufacturer apps are so bad. Clevo control center would take over a minute…

Nice! If it doesn't exist yet, I'd also recommend taking it a step further and writing an OpenRGB controller for it, so even more people can benefit from the reverse engineering effort.

Re: MSI Center – How to gain SYSTEM privileges in seconds

#33

Post by oneshtein »

VorpalWay wrote: post #19
matheusmoreira wrote: post #8

Earlier quoted context omitted.

> this is the terribly written software that you need to turn off all the obnoxious lights on your MB and DRAM You should reverse engineer it and write a free software replacement! I did this for my Clevo laptop's keyboard LEDs: https://github.com/matheusmoreira/ite-829x Still one of my most satisfying projects and I use it to this day. These manufacturer apps are so bad. Clevo control center would take over a minute…

I did some ACPI reverse engineering on an old Toshiba laptop some years ago, with the goal of improving the Linux ACPI drivers. Learnt a lot from it, and wrote a blog post that you might find interesting: https://vorpal.se/posts/2022/aug/21/reverse-engineering-acpi... (100% human written, and I hate that I have to specify that these days).

#handmade_comment

Very good article, thank you!

Re: MSI Center – How to gain SYSTEM privileges in seconds

#34

Post by lnenad »

userbinator wrote: post #26
lnenad wrote: post #20

Earlier quoted context omitted.

You understand the concept of doing something that doesn't bring direct monetary benefit?

In other words, bootlicking the corpo-authoritarians?

You're actually helping the people that use the software from getting pwned, companies are secondary beneficiaries.

Re: MSI Center – How to gain SYSTEM privileges in seconds

#35

Post by lnenad »

nicman23 wrote: post #25
lnenad wrote: post #20

Earlier quoted context omitted.

You understand the concept of doing something that doesn't bring direct monetary benefit?

you understand the concept of zero days ? companies should be better and if not, criminally liable for their bad code.

Ok? I agree with everything. What does that have to do with reporting exploits that don't have bounties?

Re: MSI Center – How to gain SYSTEM privileges in seconds

#36

Post by dist-epoch »

nicman23 wrote: post #25
lnenad wrote: post #20

Earlier quoted context omitted.

You understand the concept of doing something that doesn't bring direct monetary benefit?

you understand the concept of zero days ? companies should be better and if not, criminally liable for their bad code.

I don't think you thought this through.

does this also apply to individual developers?

should Linux Torvalds or the ffmpeg developers go to jail if they merge a RCE zero-day into the Linux kernel or into ffmpeg?

Re: MSI Center – How to gain SYSTEM privileges in seconds

#37

Post by tosti »

eur0pa wrote: post #21

> However, because the named pipe only responds to authenticated users, successful exploitation requires valid login credentials for the target machine. Eh

Authenticated for shared files and printers. The pipe itself doesn't authenticate much, but the built-in network server does.

Re: MSI Center – How to gain SYSTEM privileges in seconds

#38

Post by everyflavourvms »

ashikns wrote: post #23
drdexebtjl wrote: post #5

I wish the author went into a bit more detail about how MSI fixed it, as is usual in write ups like this. It left me thinking maybe the patch introduced a different vulnerability that’s still under an embargo :)

Video by GN has a little bit of info (but not a lot). Basically they made it so that the pipes only accept input from MSI signed software + the pipes can only invoke MSI signed executables. https://youtu.be/Eck8NnoaD4M

> pipes only accept input from MSI signed software

This does not inspire confidence. I'm assuming the pipe exists so that some GUI process running as the current user can perform privileged actions since the other end of the pipe runs as SYSTEM. At this point, just inject a thread into that GUI process and send the command - the service will think it is coming from MSI software, because it is.

The "only invoke MSI signed executables" mitigation is a good one, but if these two things are all they have done, while leaving the "arbitrary registry write" primitive in, then this is still 100% vulnerable to local privilege escalation.

Re: MSI Center – How to gain SYSTEM privileges in seconds

#39

Post by zipy124 »

MSI Center is one of the worst pieces of software that I can't get rid of. Some features I can't find easy ways to replicate such as controlling the fan/GPU/CPU profiles and battery charging. Updating the software takes FOREVER for what should be fairly simple, and it is extremely slow again for what should be simple software.
Post reply on HN