WinSMS 3.43 - Insecure File Permissions Privilege Escalation

# Exploit Title: WinSMS 3.43 Local Privilege Escalation
# Date: 13/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: http://www.winsms.co.za
# Software Link: https://www.winsms.co.za/products/bulk-sms-desktop-software/
# Version: Software Version 3.43, Released September 2015
# Tested on: Windows 10 Professional x64 and Windows XP SP3 x86


1. Description:

WinSMS installs by default to "C:\Program Files (x86)\WinSMS" with very weak folder permissions granting any user full permission to the contents of the directory and it's subfolders. This allows ample opportunity for code execution against any other user running the application. WinSMS is typically configured as a startup program which makes this particularly easy to take leverage.

2. Proof

C:\Program Files>cacls WinSMS
C:\Program Files\WinSMS Everyone:(OI)(CI)F
                        BUILTIN\Users:R
                        BUILTIN\Users:(OI)(CI)(IO)(special access:)
                                                  GENERIC_READ
                                                  GENERIC_EXECUTE
                        BUILTIN\Power Users:C
                        BUILTIN\Power Users:(OI)(CI)(IO)C
                        BUILTIN\Administrators:F
                        BUILTIN\Administrators:(OI)(CI)(IO)F
                        NT AUTHORITY\SYSTEM:F
                        NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
                        TULPA-842269BBB\Administrator:F
                        CREATOR OWNER:(OI)(CI)(IO)F


3. Exploit:

Simply replace WinSMS.exe or any of the dll's with your preferred payload and wait for execution.

4. Plain Text Password Disclosure:

It is worth noting that sensitive information such as the proxy server password is stored in plain text within the a database file located at "C:\Program Files (x86)\WinSMS\WinSMS.mdb"