68 lines
No EOL
3.6 KiB
Text
68 lines
No EOL
3.6 KiB
Text
# Exploit Title: Multiple Icecream Apps Local Privilege Escalation
|
|
# Date: 13/09/2016
|
|
# Exploit Author: Tulpa
|
|
# Contact: tulpa@tulpa-security.com
|
|
# Author website: www.tulpa-security.com
|
|
# Vendor Homepage: icecreamapps.com
|
|
# Software Versions Affected: Icecream Ebook Reader 4.21 | Icecream Screen Recorder 4.21 | Icecream Screen Recorder 2.12
|
|
# Software Link: http://icecreamapps.com/Ebook-Reader/ | http://icecreamapps.com/Screen-Recorder/ | http://icecreamapps.com/Slideshow-Maker/
|
|
# Tested on: Windows 10 Professional x64 and Windows XP SP3 x86
|
|
|
|
|
|
1. Description:
|
|
|
|
The default installation directory for Icecream Ebook Reader is "C:\Program Files (x86)\Icecream Ebook Reader" with weak folder permissions that grants EVERYONE change/modify
|
|
|
|
privileges to the contents of the directory and it's subfolders. This allows an attacker opportunity for their own code execution under any other user running the
|
|
|
|
application. The same vulnerability exists for "Icecream Screen Recorder" as well as "Icecream Slideshow Maker".
|
|
|
|
2. Proof
|
|
|
|
C:\Program Files (x86)>icacls "Icecream Ebook Reader"
|
|
Icecream Ebook Reader Everyone:(OI)(CI)(M)
|
|
NT SERVICE\TrustedInstaller:(I)(F)
|
|
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
|
|
NT AUTHORITY\SYSTEM:(I)(F)
|
|
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
|
|
BUILTIN\Administrators:(I)(F)
|
|
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
|
|
BUILTIN\Users:(I)(RX)
|
|
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
|
|
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
|
|
|
|
C:\Program Files (x86)>icacls "Icecream Screen Recorder"
|
|
Icecream Screen Recorder Everyone:(OI)(CI)(M)
|
|
NT SERVICE\TrustedInstaller:(I)(F)
|
|
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
|
|
NT AUTHORITY\SYSTEM:(I)(F)
|
|
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
|
|
BUILTIN\Administrators:(I)(F)
|
|
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
|
|
BUILTIN\Users:(I)(RX)
|
|
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
|
|
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
|
|
|
|
C:\Program Files\Icecream Slideshow Maker Everyone:(OI)(CI)C
|
|
BUILTIN\Users:R
|
|
BUILTIN\Users:(OI)(CI)(IO)(special access:)
|
|
GENERIC_READ
|
|
GENERIC_EXECUTE
|
|
BUILTIN\Power Users:C
|
|
BUILTIN\Power Users:(OI)(CI)(IO)C
|
|
BUILTIN\Administrators:F
|
|
BUILTIN\Administrators:(OI)(CI)(IO)F
|
|
NT AUTHORITY\SYSTEM:F
|
|
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
|
|
TULPA-842269BBB\Administrator:F
|
|
CREATOR OWNER:(OI)(CI)(IO)F
|
|
|
|
|
|
|
|
3. Exploit:
|
|
|
|
Simply replace any of the application exe's or any of the dll's with your preferred payload and wait for execution. |