bugtraq - Privilege escalation in BulletProof FTP Server v2.4.0.31

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <80115b69050427102530b5ab91@mail.gmail.com>
Date: Wed, 27 Apr 2005 10:25:40 -0700
From: Reed Arvin <reedarvin@...il.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	vuln@...unia.com, news@...uriteam.com
Subject: Privilege escalation in BulletProof FTP Server
	v2.4.0.31

Summary:
Privilege escalation in BulletProof FTP Server v2.4.0.31
(http://www.bpftpserver.com/)

Details:
When the BPFTPServer service is installed and running as LocalSystem
it is possible to manipulate the administrative interface and escalate
privileges to that of the LocalSystem account.

Vulnerable Versions:
Privilege escalation in BulletProof FTP Server v2.4.0.31

Patches/Workarounds:
The vendor was notified of the issue. There was no response.

Exploit:
1. Right click the BulletProof FTP Server tray icon and click Show Server.
2. Click the Help icon.
3. Internet Explorer will open (running under the context of the
LocalSystem account). Click File, Click Open.
4. Click Browse.
5. Change Files of type: to All Files, navigate to the system32
directory and locate cmd.exe.  Right click cmd.exe and choose Open.

The result is a command prompt running under the context of the
LocalSystem account.

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/