# Local Privilege Escalation in anti_ransomware_service.exe via quarantine

Acronis anti_ransomware_service.exe copies quarantined files as SYSTEM into a user-writable folder, letting a hardlink overwrite arbitrary files and escalate to SYSTEM.

- Payout: hidden
- Severity: medium
- Program: Acronis
- Found by: mjoensen
- Disclosed: 2021-06-24
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/858598
- Library page: https://bugbountylibrary.com/r/h1%3A858598
- Tags: area:os domain:desktop impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:rest tech:windows technique:chained vuln:misconfiguration vuln:privilege-escalation

**Target:** anti_ransomware_service.exe quarantine REST API (localhost:6109)
**Root cause:** The SYSTEM-privileged service copies detected files into a quarantine directory writable by unprivileged users, following a hardlink/symlink placed there instead of writing to a fresh file.
**Steps:**
1. Create `C:\Acronis Active Protection Storage\Quarantine\` as unprivileged user
2. Place ransomware_sim.exe in `C:\ProgramData\` and run it to trigger detection
3. Press Block on the Acronis dialog (do not close)
4. Run `CreateSymlink.exe "C:\Acronis Active Protection Storage\Quarantine\ProgramData\ransomware_sim.exe" "C:\Windows\SysWOW64\dpnsvr.exe"`
5. POST `{"action":"MoveToQuarantine"}` to `http://localhost:6109/alerts/<uniqueId>` to force the privileged copy
6. Verify dpnsvr.exe overwritten with attacker payload
**How found:** Noticed the quarantine folder is user-writable while the service writes to it as SYSTEM, hypothesized a hardlink could redirect the privileged write, and used the REST API to force the quarantine move.
**Exploitation:** Attacker plants a hardlink in the user-writable quarantine path pointing at a SYSTEM-executed binary, then forces the service via its localhost REST API to move the detected file into quarantine, overwriting the target with attacker-controlled content; the payload executes as SYSTEM.
**Escalation:** Arbitrary SYSTEM write to any file enables overwriting a privileged executable to gain SYSTEM code execution.
**Insight:** When a privileged service writes into a directory the low-priv user can create/modify, plant a hardlink at the exact destination filename the service will use and trigger the copy via the service's own API rather than waiting for natural detection.