# Arbitrary DLL injection in mmsminisrv (Acronis Managed Machine Service Mini)

Acronis mms_mini.exe loads a hardcoded OpenSSL config from a user-writable C:\ path, letting a low-privileged user plant openssl.cnf and a DLL to run code as Local System.

- Payout: hidden
- Severity: high
- Program: Acronis
- Found by: adr
- Disclosed: 2020-10-20
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/944735
- Library page: https://bugbountylibrary.com/r/h1%3A944735
- Tags: area:os domain:desktop impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:windows technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows service binary mms_mini.exe (mmsminisrv) loading libssl10.dll
**Root cause:** libssl10.dll attempts to load openssl.cnf from a hardcoded build path (C:\bs_hudson\workspace\...) left over from compilation; the C:\ directory is user-writable, and OpenSSL config supports dynamic engine DLL loading.
**Steps:**
1. `mkdir C:\bs_hudson\workspace\mod-openssl-fips-win\205\product\out\standard\vs_2013_release\OpenSSL\ssl`
2. Create `openssl.cnf` there with `openssl_conf = openssl_init`, `[openssl_init] engines = engine_section`, `[engine_section] woot = woot_section`, `[woot_section] engine_id = woot`, `dynamic_path = c:\\temp\\cqbeacondll.dll`, `init = 0`
3. Plant attacker DLL at the dynamic_path location
4. Wait for service start or reboot to trigger load as Local System
**How found:** Observed via Procmon that mms_mini.exe loads libssl10.dll which then probes a non-existent hardcoded build path for openssl.cnf; recognized the path was user-creatable and that OpenSSL config supports dynamic engine loading.
**Exploitation:** Low-privileged local user creates the missing directory tree and openssl.cnf pointing dynamic_path at a malicious DLL; on service restart the Local System service loads the DLL, executing arbitrary code (e.g. add admin user or reverse shell).
**Insight:** Watch Procmon for services probing non-existent files under user-writable roots (especially hardcoded build paths); OpenSSL config's engines/dynamic_path turns a missing-config file into DLL load as SYSTEM.