{PRL} My Remote File Server Privilege Escalation

[Protek Research Lab <protekresearchlab@xxxxxxxx>]

#####################################################################################

Application:  My Remote File Server
            
Platforms:    Windows XP Professional SP2

Exploitation: Privilege Escalation

Date:         2009-10-26

Author:       Francis Provencher (Protek Research Lab's) 

          
#####################################################################################

1) Introduction
2) Technical details
3) The Code (N/A)


#####################################################################################

===============
1) Introduction
===============
     

My Remote Files Server Edition is special Windows software that helps to 
organize simultaneous access to shared files on a server computer from 
different 

computers in your local network and from the Internet. 


(from smrksoft website)


2009/10/30 Vendor contacted
2009/10/30 Vendor response (That not a security hole but a feature....)
2009/10/30 Release this advisory

#####################################################################################

============================
2) Technical details 
============================

My Remote File Server
Build 2.4.1

All files under the install folder have Create access control for BUILTIN\users 
and can be replace with malicious files.

This application have two modes; 

Standalone mode; You will gain the privilege of the user that start the 
application
Service mode; You will gain administrative privilege


The application have an other hole, In the install folder we can find the 
private key for SSL communication and certificate is also availlable. 
Builtin\user can use it to decrypt communication with the server or impersonate 
them....


... snip ...

C:\Program Files\Remote Files Server\mserver.exe BUILTIN\Utilisateurs:C
                                                 BUILTIN\Utilisateurs avec 
pouvoir:C
                                                 BUILTIN\Administrateurs:F
                                                 AUTORITE NT\SYSTEM:F
                                                 FUZZYXP\test:C
... snip ...

C:\>WHOAMI.EXE
FUZZYXP\test

C:\>telnet 127.0.0.1 4444


C:\>WHOAMI.EXE
WHOAMI.EXE
AUTORITE NT\SYSTEM





#####################################################################################

===========
3) The Code
===========

N\A


#####################################################################################
(PRL-2009-16)



      __________________________________________________________________
Looking for the perfect gift? Give the gift of Flickr! 

http://www.flickr.com/gift/