Local Privilege Escalation via Weak Service Binary Permissions

Attackers with local access to the medical office computer can

escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by

overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is

writable for all users. In addition, the Elefant installer registers two

Firebird database services which are running as “NT AUTHORITY\SYSTEM”.

Path: C:\Elefant1\Firebird_2\bin\fbserver.exe

Path: C:\Elefant1\Firebird_2\bin\fbguard.exe

Both service binaries are user writable. This means that a local

attacker can rename one of the service binaries, replace the service

executable with a new executable, and then restart the system. Once the

system has rebooted, the new service binary is executed as "NT

AUTHORITY\SYSTEM".