# Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service)

Acronis syncagentsrv follows a symlink on its log path, letting a low-priv user write an arbitrary DLL to system32 and escalate to SYSTEM.

- Payout: hidden
- Severity: high
- Program: Acronis
- Found by: adr
- Disclosed: 2021-03-16
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/945122
- Library page: https://bugbountylibrary.com/r/h1%3A945122
- Tags: area:os domain:desktop impact:integrity impact:privesc kind:bounty platform:hackerone sev:high tech:windows technique:chained vuln:path-traversal vuln:privilege-escalation

**Target:** Windows service syncagentsrv.exe log file write
**Root cause:** The service writes to C:\ProgramData\Acronis\SyncAgent\logs\syncagent.log without exclusive open or protection, and follows NTFS junctions/symlinks placed at that path, writing attacker-controlled content to an arbitrary destination.
**Steps:**
1. Delete `C:\ProgramData\Acronis\SyncAgent\logs\syncagent.log` so the directory is empty.
2. Run `CreateSymlink.exe C:\ProgramData\Acronis\SyncAgent\logs\syncagent.log C:\Windows\system32\WptsExtensions.dll`.
3. Wait for a log write or force it via reboot; verify the file was created at the target.
4. Replace the created file content with a malicious DLL (add admin user / reverse shell).
5. Reboot to trigger Windows Scheduler loading WptsExtensions.dll as SYSTEM.
**How found:** Noticed the log file was not exclusively opened nor protected and could be deleted, leaving the logs directory empty and thus convertible into a junction/symlink; hypothesized the service would blindly follow it on the next write.
**Exploitation:** Low-priv user plants a junction/symlink at the log path; the service's next log write creates an attacker-named file in system32 with full control for EVERYONE, which is then overwritten with a malicious DLL and loaded by the Windows schedule service on reboot, yielding SYSTEM.
**Escalation:** Arbitrary file creation chained with a known Windows DLL hijack (WptsExtensions.dll loaded by the schedule service) to reach Local System.
**Insight:** Look for privileged services that write logs to a deletable, non-exclusively-opened file in a user-writable directory; an empty parent directory can be swapped for a junction to redirect the write to system32 with an attacker-chosen filename.