Home / vulnerabilities mrfs-escalate.txt
Posted on 30 October 2009
Source : packetstormsecurity.org Link
#####################################################################################
Application: My Remote File Server
Platforms: Windows XP Professional SP2
Exploitation: Privilege Escalation
Date: 2009-10-26
Author: Francis Provencher (Protek Research Lab's)
#####################################################################################
1) Introduction
2) Technical details
3) The Code (N/A)
#####################################################################################
===============
1) Introduction
===============
My Remote Files Server Edition is special Windows software that helps to organize simultaneous access to shared files on a server computer from different
computers in your local network and from the Internet.
(from smrksoft website)
2009/10/30 Vendor contacted
2009/10/30 Vendor response (That not a security hole but a feature....)
2009/10/30 Release this advisory
#####################################################################################
============================
2) Technical details
============================
My Remote File Server
Build 2.4.1
All files under the install folder have Create access control for BUILTINusers and can be replace with malicious files.
This application have two modes;
Standalone mode; You will gain the privilege of the user that start the application
Service mode; You will gain administrative privilege
The application have an other hole, In the install folder we can find the private key for SSL communication and certificate is also availlable. Builtinuser can use it to decrypt communication with the server or impersonate them....
... snip ...
C:Program FilesRemote Files Servermserver.exe BUILTINUtilisateurs:C
BUILTINUtilisateurs avec pouvoir:C
BUILTINAdministrateurs:F
AUTORITE NTSYSTEM:F
FUZZYXP est:C
... snip ...
C:>WHOAMI.EXE
FUZZYXP est
C:>telnet 127.0.0.1 4444
C:>WHOAMI.EXE
WHOAMI.EXE
AUTORITE NTSYSTEM
#####################################################################################
===========
3) The Code
===========
NA
#####################################################################################
(PRL-2009-16)
__________________________________________________________________
Looking for the perfect gift? Give the gift of Flickr!
http://www.flickr.com/gift/
