Wondershare Dr.Fone Elevation Service Remote Code Execution (RCE) Vulnerability (WonderShell)

Vulnerability Overview Vulnerability Name: WonderShell Discoverers: Tomer Peled & Netanel Cohen Background: This vulnerability involves the Dr. Fone application, which is used for data transfer between two mobile devices. However, it acts as a "backdoor" that does not remove itself even after the application is uninstalled. Vulnerability Type: Remote Code Execution (RCE) Vulnerability Locations: - Elevation Service: Listens on port 12345, discovered via process hacker network tags. - InstallAssistService: Listens on a random UDP port, with the port number stored in . Impact Scope User Privileges: Remote code execution from USER to SYSTEM privileges. Persistence: The vulnerability persists even after the program is removed. Exploitation Method: - Achieving RCE by modifying the hardcoded IP address (127.0.0.1). - Utilizing the msgpack library for RPC communication. Remediation No specific remediation provided, but recommendations include: - Inspect and secure the communication mechanisms of the Elevation Service and InstallAssistService. - Ensure the application does not leave behind backdoors upon uninstallation. - Update the usage of the msgpack library to avoid hardcoded IP addresses. POC Code Additional Information Related Tools: - Detect-It-Easy: Used for language identification. - Wireshark: Used for network communication analysis. - Dnspy: Used for reverse engineering. Related Links: - GitHub POC - msgpack-rpc-cpp - msgpack RPC Documentation - msgpack Project Summary This vulnerability involves the Elevation Service and InstallAssistService of the Dr. Fone application, enabling Remote Code Execution through the modification of hardcoded IP addresses and the msgpack library. It is recommended to inspect and secure the communication mechanisms of these services and ensure no backdoors remain after application uninstallation.

Goal Reached Thanks to every supporter — we hit 100%!

Wondershare Dr.Fone Elevation Service Remote Code Execution (RCE) Vulnerability (WonderShell)