04.27.05

Summary:
Privilege escalation in BulletProof FTP Server v2.4.0.31 (http://www.bpftpserver.com/)

Details:
When the BPFTPServer service is installed and running as LocalSystem it is possible to manipulate the administrative interface and escalate privileges to that of the LocalSystem account.

Vulnerable Versions:
BulletProof FTP Server v2.4.0.31

Patches/Workarounds:
The vendor was notified of the issue. There was no response.

Exploits:

1. Right click the BulletProof FTP Server tray icon and click Show Server.

2. Click the Help icon.

3. Internet Explorer will open (running under the context of the LocalSystem
   account). Click File, Click Open.

4. Click Browse.

5. Change Files of type: to All Files, navigate to the system32 directory and
   locate cmd.exe.  Right click cmd.exe and choose Open.

The result is a command prompt running under the context of the LocalSystem
account.

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)