# Exploit Title: WinSMS 3.43 Local Privilege Escalation # Date: 13/09/2016 # Exploit Author: Tulpa # Contact: tulpa@tulpa-security.com # Author website: www.tulpa-security.com # Vendor Homepage: http://www.winsms.co.za # Software Link: https://www.winsms.co.za/products/bulk-sms-desktop-software/ # Version: Software Version 3.43, Released September 2015 # Tested on: Windows 10 Professional x64 and Windows XP SP3 x86 1. Description: WinSMS installs by default to "C:Program Files (x86)WinSMS" with very weak folder permissions granting any user full permission to the contents of the directory and it's subfolders. This allows ample opportunity for code execution against any other user running the application. WinSMS is typically configured as a startup program which makes this particularly easy to take leverage. 2. Proof C:Program Files>cacls WinSMS C:Program FilesWinSMS Everyone:(OI)(CI)F BUILTINUsers:R BUILTINUsers:(OI)(CI)(IO)(special access:) GENERIC_READ GENERIC_EXECUTE BUILTINPower Users:C BUILTINPower Users:(OI)(CI)(IO)C BUILTINAdministrators:F BUILTINAdministrators:(OI)(CI)(IO)F NT AUTHORITYSYSTEM:F NT AUTHORITYSYSTEM:(OI)(CI)(IO)F TULPA-842269BBBAdministrator:F CREATOR OWNER:(OI)(CI)(IO)F 3. Exploit: Simply replace WinSMS.exe or any of the dll's with your preferred payload and wait for execution. 4. Plain Text Password Disclosure: It is worth noting that sensitive information such as the proxy server password is stored in plain text within the a database file located at "C:Program Files (x86)WinSMSWinSMS.mdb"