56 lines
No EOL
1.9 KiB
Text
56 lines
No EOL
1.9 KiB
Text
# Exploit Title: Epic Games Easy Anti-Cheat 4.0 - Local Privilege Escalation
|
||
# Date: 04.05.2021
|
||
# Exploit Author: LiquidWorm
|
||
# Vendor Homepage: https://www.epicgames.com https://www.easy.ac
|
||
|
||
Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation
|
||
|
||
|
||
Vendor: Epic Games, Inc.
|
||
Product web page: https://www.epicgames.com
|
||
https://www.easy.ac
|
||
Affected version: 4.0.0.0
|
||
|
||
Summary: Easy Anti-Cheat is the industry-leading anti–cheat service,
|
||
countering hacking and cheating in multiplayer PC games through the
|
||
use of hybrid anti–cheat mechanisms.
|
||
|
||
Desc: The application suffers from an unquoted search path issue impacting
|
||
the service 'EasyAntiCheat' for Windows deployed as part of Easy Anti-Cheat
|
||
Service application. This could potentially allow an authorized but non-privileged
|
||
local user to execute arbitrary code with elevated privileges on the system.
|
||
A successful attempt would require the local user to be able to insert their
|
||
code in the system root path undetected by the OS or other security applications
|
||
where it could potentially be executed during application startup or reboot.
|
||
If successful, the local user's code would execute with the elevated privileges
|
||
of the application.
|
||
|
||
Tested on: Microsoft Windows 10
|
||
|
||
|
||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||
@zeroscience
|
||
|
||
|
||
Advisory ID: ZSL-2021-5652
|
||
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5652.php
|
||
|
||
|
||
04.05.2021
|
||
|
||
--
|
||
|
||
|
||
C:\Users>sc qc EasyAntiCheat
|
||
[SC] QueryServiceConfig SUCCESS
|
||
|
||
SERVICE_NAME: EasyAntiCheat
|
||
TYPE : 10 WIN32_OWN_PROCESS
|
||
START_TYPE : 3 DEMAND_START
|
||
ERROR_CONTROL : 1 NORMAL
|
||
BINARY_PATH_NAME : C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
|
||
LOAD_ORDER_GROUP :
|
||
TAG : 0
|
||
DISPLAY_NAME : EasyAntiCheat
|
||
DEPENDENCIES :
|
||
SERVICE_START_NAME : LocalSystem |