WinSMS 3.43 Local Privilege Escalation

vendor:

Bulk SMS Desktop Software

by:

Tulpa

5.5

CVSS

MEDIUM

Local Privilege Escalation

269

CWE

Product Name: Bulk SMS Desktop Software

Affected Version From: 3.43

Affected Version To: 3.43

Patch Exists: NO

Related CWE:

CPE: a:winsms:desktop_software:3.43

Metasploit:

Other Scripts:

Platforms Tested: Windows 10 Professional x64, Windows XP SP3 x86

2016

WinSMS 3.43 Local Privilege Escalation

WinSMS installs with weak folder permissions, allowing any user to execute code against other users running the application. Additionally, sensitive information such as the proxy server password is stored in plain text.

Mitigation:

The vendor should update the folder permissions to restrict access and encrypt sensitive information.

Source

Exploit-DB raw data:

# Exploit Title: WinSMS 3.43 Local Privilege Escalation
# Date: 13/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: http://www.winsms.co.za
# Software Link: https://www.winsms.co.za/products/bulk-sms-desktop-software/
# Version: Software Version 3.43, Released September 2015
# Tested on: Windows 10 Professional x64 and Windows XP SP3 x86


1. Description:

WinSMS installs by default to "C:\Program Files (x86)\WinSMS" with very weak folder permissions granting any user full permission to the contents of the directory and it's subfolders. This allows ample opportunity for code execution against any other user running the application. WinSMS is typically configured as a startup program which makes this particularly easy to take leverage.

2. Proof

C:\Program Files>cacls WinSMS
C:\Program Files\WinSMS Everyone:(OI)(CI)F
                        BUILTIN\Users:R
                        BUILTIN\Users:(OI)(CI)(IO)(special access:)
                                                  GENERIC_READ
                                                  GENERIC_EXECUTE
                        BUILTIN\Power Users:C
                        BUILTIN\Power Users:(OI)(CI)(IO)C
                        BUILTIN\Administrators:F
                        BUILTIN\Administrators:(OI)(CI)(IO)F
                        NT AUTHORITY\SYSTEM:F
                        NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
                        TULPA-842269BBB\Administrator:F
                        CREATOR OWNER:(OI)(CI)(IO)F


3. Exploit:

Simply replace WinSMS.exe or any of the dll's with your preferred payload and wait for execution.

4. Plain Text Password Disclosure:

It is worth noting that sensitive information such as the proxy server password is stored in plain text within the a database file located at "C:\Program Files (x86)\WinSMS\WinSMS.mdb"