#####################################################################################

Application:  My Remote File Server
            
Platforms:    Windows XP Professional SP2

Exploitation: Privilege Escalation

Date:         2009-10-26

Author:       Francis Provencher (Protek Research Lab's) 

          
#####################################################################################

1) Introduction
2) Technical details
3) The Code (N/A)


#####################################################################################

===============
1) Introduction
===============
     

My Remote Files Server Edition is special Windows software that helps to organize simultaneous access to shared files on a server computer from different 

computers in your local network and from the Internet. 


(from smrksoft website)


2009/10/30 Vendor contacted
2009/10/30 Vendor response (That not a security hole but a feature....)
2009/10/30 Release this advisory

#####################################################################################

============================
2) Technical details 
============================

My Remote File Server
Build 2.4.1

All files under the install folder have Create access control for BUILTIN\users and can be replace with malicious files.

This application have two modes; 

Standalone mode; You will gain the privilege of the user that start the application
Service mode; You will gain administrative privilege


The application have an other hole, In the install folder we can find the private key for SSL communication and certificate is also availlable. Builtin\user can use it to decrypt communication with the server or impersonate them....


... snip ...

C:\Program Files\Remote Files Server\mserver.exe BUILTIN\Utilisateurs:C
                                                 BUILTIN\Utilisateurs avec pouvoir:C
                                                 BUILTIN\Administrateurs:F
                                                 AUTORITE NT\SYSTEM:F
                                                 FUZZYXP\test:C
... snip ...

C:\>WHOAMI.EXE
FUZZYXP\test

C:\>telnet 127.0.0.1 4444


C:\>WHOAMI.EXE
WHOAMI.EXE
AUTORITE NT\SYSTEM





#####################################################################################

===========
3) The Code
===========

N\A


#####################################################################################
(PRL-2009-16)



      __________________________________________________________________
Looking for the perfect gift? Give the gift of Flickr! 

http://www.flickr.com/gift/