# Denial of Service in anti_ransomware_service.exe via logs files

Unprivileged user hardlinks predictable anti-ransomware log file to the service binary, causing a sharing violation crash on every reboot and silently disabling ransomware protection.

- Payout: hidden
- Severity: medium
- Program: Acronis
- Found by: mjoensen
- Disclosed: 2021-06-24
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/858603
- Library page: https://bugbountylibrary.com/r/h1%3A858603
- Tags: area:os domain:desktop impact:dos kind:bounty platform:hackerone sev:medium tech:windows technique:source-review vuln:dos vuln:misconfiguration

**Target:** Windows service anti_ransomware_service.exe log directory
**Root cause:** The service writes logs to a world-writable directory (C:\ProgramData\Acronis\ActiveProtection\Logs) using a predictable filename pattern, and does not verify the log file is not a hardlink to a protected binary before writing.
**Steps:**
1. Obtain James Forshaw's symboliclink-testing-tools (CreateHardlink.exe).
2. Identify next log filename in sequence, e.g. `active_protection.2.log` if `.1.log` exists.
3. Run `CreateHardlink.exe "C:\ProgramData\Acronis\ActiveProtection\Logs\active_protection.2.log" "C:\Program Files (x86)\Common Files\Acronis\ActiveProtection\anti_ransomware_service.exe"`.
4. Reboot; service attempts to write log into its own binary, hits SHARING VIOLATION and crashes.
5. Verify anti_ransomware_service.exe is not running after reboot.
**How found:** Noticed the service logs into a directory writable by any unprivileged user with a predictable incrementing filename, then hypothesized a hardlink could redirect the log write onto the service binary itself.
**Exploitation:** An unprivileged local user pre-creates a hardlink at the next predictable log path pointing to the service executable. On reboot the service opens the log for writing, colliding with the running image and crashing with a sharing violation; the crash recurs every boot, silently disabling anti-ransomware protection.
**Escalation:** Persistent across reboots because the hardlink remains and the log filename advances predictably, keeping protection disabled indefinitely.
**Insight:** Predictable log filenames in world-writable directories are a hardlink/symlink target: pre-create the next filename as a hardlink to a privileged binary or config so the service's own write corrupts or crashes it on next start.