CVE-2022-26235: Remisol Advance Normand Message Server

CVE-2022-26235: Remisol Advance Normand Message Server

A vulnerability was discovered in the Remisol Advance v2.0.12.1 and below for the Normand Message Server. On installation, the permissions set by Remisol Advance allow non-privileged users to overwrite and/or manipulate executables and libraries that run as the elevated SYSTEM user on Windows.

To recreate the conditions for exploitation, do the following;

Step 1: Obtain low-level permission to a workstation (these workstations are usually protected with a weak password, a default vendor password or no password).
Step 2: Replace the message server service executable (MessageServer.exe or any associated library used with the service) with a malicious or PoC binary. Note: This service and its executable may be named something else in different regions, please check the services installed in Windows.
Step 3: Restart the machine or service, whichever is more accessible.
Step 4: Your binary will be started as the SYSTEM/NT Authority user.

The fix is simple: correct the permissions so that every user cannot overwrite the services and make themselves a super admin on the local Windows host.


✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1S1iTruSLkgEPO8QtTuo2twS4f2FoJ3_l0-p4GKqeAUY/edit?usp=sharing

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 25% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from SimpleSwap — instant swap).