58 lines
No EOL
2.2 KiB
Text
58 lines
No EOL
2.2 KiB
Text
# Exploit Title: Battle.Net 1.5.0.7963 Local Privilege Escalation
|
|
# Date: 11/09/2016
|
|
# Exploit Author: Tulpa
|
|
# Contact: tulpa@tulpa-security.com
|
|
# Author website: www.tulpa-security.com
|
|
# Vendor Homepage: www.battle.net
|
|
# Software Link: https://eu.battle.net/account/download/
|
|
# Version: Version 1.5.0.7963
|
|
# Tested on: Windows 10 Professional x64 and Windows XP SP3 x86
|
|
|
|
|
|
1. Description:
|
|
|
|
Battle.Net installs by default to "C:\Program Files (x86)\Battle.Net" with weak folder permissions granting any built-in user account with full permission to the contents of
|
|
|
|
the directory and it's subfolders. This allows an attacker opportunity for their own code execution under any other user running the application. This is not limited to just
|
|
|
|
the Battle.Net directory, but also to any of Blizzards game installation folders as installed by Battle.Net.
|
|
|
|
2. Proof
|
|
|
|
C:\Program Files>cacls Battle.net
|
|
C:\Program Files\Battle.net BUILTIN\Users:(OI)(CI)F
|
|
BUILTIN\Administrators:(OI)(CI)F
|
|
CREATOR OWNER:(OI)(CI)F
|
|
|
|
|
|
C:\Program Files>cacls "Diablo III"
|
|
C:\Program Files\Diablo III BUILTIN\Users:(OI)(CI)F
|
|
BUILTIN\Administrators:(OI)(CI)F
|
|
CREATOR OWNER:(OI)(CI)F
|
|
|
|
|
|
C:\Program Files>cacls "StarCraft II"
|
|
C:\Program Files\StarCraft II BUILTIN\Users:(OI)(CI)F
|
|
BUILTIN\Administrators:(OI)(CI)F
|
|
CREATOR OWNER:(OI)(CI)F
|
|
|
|
|
|
C:\Program Files>cacls Hearthstone
|
|
C:\Program Files\Hearthstone BUILTIN\Users:(OI)(CI)F
|
|
BUILTIN\Administrators:(OI)(CI)F
|
|
CREATOR OWNER:(OI)(CI)F
|
|
|
|
|
|
C:\Program Files>cacls "Heroes of the Storm"
|
|
C:\Program Files\Heroes of the Storm BUILTIN\Users:(OI)(CI)F
|
|
BUILTIN\Administrators:(OI)(CI)F
|
|
CREATOR OWNER:(OI)(CI)F
|
|
|
|
C:\Program Files (x86)>cacls "World of Warcraft"
|
|
C:\Program Files (x86)\World of Warcraft BUILTIN\Users:(OI)(CI)F
|
|
BUILTIN\Administrators:(OI)(CI)F
|
|
CREATOR OWNER:(OI)(CI)F
|
|
|
|
3. Exploit:
|
|
|
|
Simply replace any of the game exe's or any of the dll's with your preferred payload and wait for execution. |