Home[1] Files[2] News[3] &[SERVICES_TAB] Contact[4] Add New[5]
- File Replication Pro 7.5.0 Insecure Permissions / Privilege Escalation[6]
- Authored by Andrea Intilangelo[7]
-
File Replication Pro version 7.5.0 suffers from having insecure directory permissions that can allow a local attacker the ability to escalate privileges.
- advisories | CVE-2023-26918[8]
- SHA-256 |
3138a60a71e273996458f75dde264765daef7445674e569f1253db4a7267de35
- Download[9] | Favorite[10] | View[11]
Change Mirror[12] Download[13]
# Exploit Title: File Replication Pro 7.5.0 - Password disclosure/reset & PrivEsc due Incorrect Access Control
# Date: 2023-04-13
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: http://www.diasoft.net - https://www.filereplicationpro.com
# Software Link: http://www.filereplicationpro.com/install/InstData/Windows_64_Bit/VM/frpro.exe
# Version: 7.5.0
# Tested on: Windows 10 Pro 22H2 x64
# CVE: CVE-2023-26918
Incorrect file/folder permissions in Diasoft Corporation's File Replication Pro 7.5.0 allow privilege escalation by
replacing a file with another one that will be executed with "LocalSystem" rights from Windows Services application.
C:\Program Files>icacls "c:\Program Files\FileReplicationPro"
c:\Program Files\FileReplicationPro Everyone:(F)
Everyone:(OI)(CI)(IO)(F)
C:\Users\Administrator>sc qc frp
[SC] QueryServiceConfig OPERAZIONI RIUSCITE
NOME_SERVIZIO: frp
TIPO : 10 WIN32_OWN_PROCESS
TIPO_AVVIO : 2 AUTO_START
CONTROLLO_ERRORE : 1 NORMAL
NOME_PERCORSO_BINARIO : "C:\Program Files\FileReplicationPro\prunsrv.exe" //RS//frp
GRUPPO_ORDINE_CARICAMENTO :
TAG : 0
NOME_VISUALIZZATO : FRPReplicationServer
DIPENDENZE : Tcpip
: Afd
SERVICE_START_NAME : LocalSystem
To exploit the vulnerability a malicious actor/process must weaponize or replace the prunsrv.exe executable that runs
with LocalSystem privileges as "frp" (FRPReplicationServer) service, since the application's path has "Everyone" full
access permissions.
Moreover, the "properties.xml" file in the "etc" folder inside program's path contains the hashed password for remote
access stored in sha1(base64) value, that is possible to modify. Replacing it with a new hash, generated by encrypting
a string in SHA-1 and encoding its digest via base64, will grant the login access on the application's web interface.
File Tags
- ActiveX[19] (932)
- Advisory[20] (80,721)
- Arbitrary[21] (15,949)
- BBS[22] (2,859)
- Bypass[23] (1,660)
- CGI[24] (1,022)
- Code Execution[25] (7,086)
- Conference[26] (677)
- Cracker[27] (840)
- CSRF[28] (3,310)
- DoS[29] (22,981)
- Encryption[30] (2,359)
- Exploit[31] (50,897)
- File Inclusion[32] (4,190)
- File Upload[33] (951)
- Firewall[34] (821)
- Info Disclosure[35] (2,697)
- Intrusion Detection[36] (878)
- Java[37] (2,963)
- JavaScript[38] (834)
- Kernel[39] (6,487)
- Local[40] (14,325)
- Magazine[41] (586)
- Overflow[42] (12,556)
- Perl[43] (1,419)
- PHP[44] (5,112)
- Proof of Concept[45] (2,298)
- Protocol[46] (3,513)
- Python[47] (1,488)
- Remote[48] (30,371)
- Root[49] (3,541)
- Rootkit[50] (504)
- Ruby[51] (603)
- Scanner[52] (1,633)
- Security Tool[53] (7,831)
- Shell[54] (3,143)
- Shellcode[55] (1,210)
- Sniffer[56] (892)
- Spoof[57] (2,186)
- SQL Injection[58] (16,188)
- TCP[59] (2,389)
- Trojan[60] (687)
- UDP[61] (881)
- Virus[62] (663)
- Vulnerability[63] (31,418)
- Web[64] (9,485)
- Whitepaper[65] (3,740)
- x86[66] (948)
- XSS[67] (17,611)
- Other[68]
File Archives
- April 2023[69]
- March 2023[70]
- February 2023[71]
- January 2023[72]
- December 2022[73]
- November 2022[74]
- October 2022[75]
- September 2022[76]
- August 2022[77]
- July 2022[78]
- June 2022[79]
- May 2022[80]
- Older[81]
Systems
- AIX[82] (426)
- Apple[83] (1,966)
- BSD[84] (372)
- CentOS[85] (56)
- Cisco[86] (1,920)
- Debian[87] (6,721)
- Fedora[88] (1,691)
- FreeBSD[89] (1,244)
- Gentoo[90] (4,288)
- HPUX[91] (878)
- iOS[92] (342)
- iPhone[93] (108)
- IRIX[94] (220)
- Juniper[95] (67)
- Linux[96] (45,249)
- Mac OS X[97] (684)
- Mandriva[98] (3,105)
- NetBSD[99] (256)
- OpenBSD[100] (482)
- RedHat[101] (12,990)
- Slackware[102] (941)
- Solaris[103] (1,609)
- SUSE[104] (1,444)
- Ubuntu[105] (8,488)
- UNIX[106] (9,216)
- UnixWare[107] (185)
- Windows[108] (6,539)
- Other[109]
- Services
- Security Services[120]
- Hosting By
- Rokasec[121]