# Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine Service

Low-privileged user creates a mount point at Acronis PostRebootResult path; mms.exe running as SYSTEM recursively deletes the linked target folder.

- Payout: hidden
- Severity: medium
- Program: Acronis
- Found by: mmg
- Disclosed: 2024-08-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/959815
- Library page: https://bugbountylibrary.com/r/h1%3A959815
- Tags: area:os domain:desktop impact:dos impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:windows technique:source-review vuln:path-traversal vuln:privilege-escalation

**Target:** Acronis Managed Machine Service (mms.exe) on Windows
**Root cause:** mms.exe runs as SYSTEM and recursively deletes the PostRebootResult directory on service restart without checking for reparse points/mount points, following attacker-planted junctions to arbitrary paths.
**Steps:**
1. Create target folder `C:\Windows\secret\1` as admin with files inside
2. As low-priv user: `mkdir C:\Acronis`
3. Compile CreateMountPoint from googleprojectzero/symboliclink-testing-tools
4. `CreateMountPoint.exe C:\Acronis\PostRebootResult\ C:\Windows\secret\1\`
5. Restart Acronis Managed Machine Service (monitor mms.exe with Procmon)
6. Observe mms.exe deletes mount point and contents of `C:\Windows\secret\1` as SYSTEM
7. Verify with `dir /s c:\Windows\secret`
**How found:** Researcher inspected mms.exe behavior with Procmon and noticed it recursively deletes the PostRebootResult directory as SYSTEM, then tested a mount-point junction to redirect that deletion.
**Exploitation:** Attacker with Authenticated Users code execution plants a mount point at the service's PostRebootResult path pointing to a privileged folder; on service restart mms.exe (SYSTEM) recursively deletes the linked target, enabling DoS, AV/AppLocker policy removal, or privilege escalation.
**Escalation:** Deleting AV/AppLocker files lowers security controls, potentially enabling further privilege escalation.
**Insight:** Look for SYSTEM services that recursively delete or write to predictable, user-writable directories on restart; junction/mount-point redirection (CreateMountPoint) turns a benign cleanup routine into arbitrary file deletion.