---

Introduction

SafeBreach Labs discovered a new vulnerability in Acer Quick Access software.

In this post, we will demonstrate how this vulnerability can be used in order to achieve persistence, defense evasion and in some cases privilege escalation by loading an arbitrary unsigned DLL into a service that runs as SYSTEM.

Acer Quick Access

Acer Quick Access is a software which is preinstalled on most Acer PCs.

The software allows the user to toggle individual wireless devices on or off, change power-off USB charge settings, modify network sharing options, and much more.

Part of the software is running as a service which is executed as “NT AUTHORITY\SYSTEM,” which provides it with very powerful permissions.

Vulnerability

Discovery

In our initial exploration, we targeted the Acer Quick Access service based on the assumption that such a critical service would have high-permission-level access to the PC hardware as well as the capability to induce privilege escalation.

After the Acer Quick Access service started, it executed QAAdminAgent.exe as NT AUTHORITY\SYSTEM.

Once the library was loaded, we noticed the service tried to look for 3 missing DLL files in order to load it:

Note: We filtered the irrelevant events from the above screenshot.

As you can see, the service was trying to load three missing DLL files, which eventually were loaded from the c:\python27 directory – our PATH environment variable:

1. atiadlxx.dll
2. atiadlxy.dll
3. nvapi.dll

Demonstrating a DLL Hijacking Vulnerability

On our VM, the c:\python27 has an ACL which allows any authenticated user to write files onto the ACL. This makes the privilege escalation simple and allows a regular user to write the missing DLL file and achieve code execution as NT AUTHORITY\SYSTEM.

It is important to note that an administrative user or process must (1) set the directory ACLs to allow access to non-admin user accounts, and (2) modify the system’s PATH variable to include that directory.

In order to test this privilege escalation vulnerability, we compiled a DLL (unsigned) which writes the following to the filename of a txt file:

1. The username which executed it
2. The name of the DLL file

We were able to load three arbitrary DLLs and execute our code as NT AUTHORITY\SYSTEM.

Note: If the “atiadlxx.dll” file already exists, it won’t load the “atiadlxy.dll” file.

Root Cause Analysis

Once the Acer Quick Access service is started (QAAdminAgent.exe), it tries to load 3 DLL files by calling the LoadLibraryW WinAPI function: