bugtraq - {PRL} My Remote File Server Privilege Escalation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 30 Oct 2009 10:42:59 -0700 (PDT)
From: Protek Research Lab <protekresearchlab@...oo.ca>
To: bugtraq@...urityfocus.com
Subject: {PRL} My Remote File Server Privilege Escalation

#####################################################################################

Application:  My Remote File Server

Platforms:    Windows XP Professional SP2

Exploitation: Privilege Escalation

Date:         2009-10-26

Author:       Francis Provencher (Protek Research Lab's) 

#####################################################################################

1) Introduction
2) Technical details
3) The Code (N/A)

#####################################################################################

===============
1) Introduction
===============

My Remote Files Server Edition is special Windows software that helps to organize simultaneous access to shared files on a server computer from different 

computers in your local network and from the Internet. 

(from smrksoft website)

2009/10/30 Vendor contacted
2009/10/30 Vendor response (That not a security hole but a feature....)
2009/10/30 Release this advisory

#####################################################################################

============================
2) Technical details 
============================

My Remote File Server
Build 2.4.1

All files under the install folder have Create access control for BUILTIN\users and can be replace with malicious files.

This application have two modes; 

Standalone mode; You will gain the privilege of the user that start the application
Service mode; You will gain administrative privilege

The application have an other hole, In the install folder we can find the private key for SSL communication and certificate is also availlable. Builtin\user can use it to decrypt communication with the server or impersonate them....

... snip ...

C:\Program Files\Remote Files Server\mserver.exe BUILTIN\Utilisateurs:C
                                                 BUILTIN\Utilisateurs avec pouvoir:C
                                                 BUILTIN\Administrateurs:F
                                                 AUTORITE NT\SYSTEM:F
                                                 FUZZYXP\test:C
... snip ...

C:\>WHOAMI.EXE
FUZZYXP\test

C:\>telnet 127.0.0.1 4444

C:\>WHOAMI.EXE
WHOAMI.EXE
AUTORITE NT\SYSTEM

#####################################################################################

===========
3) The Code
===========

N\A

#####################################################################################
(PRL-2009-16)

      __________________________________________________________________
Looking for the perfect gift? Give the gift of Flickr! 

http://www.flickr.com/gift/