48 lines
No EOL
1.8 KiB
Text
48 lines
No EOL
1.8 KiB
Text
# Exploit Title: SOYAL 701 Server 9.0.1 - Insecure Permissions
|
|
# Date: 25.01.2021
|
|
# Exploit Author: LiquidWorm
|
|
# Vendor Homepage: https://www.soyal.com.tw https://www.soyal.com
|
|
|
|
Vendor: SOYAL Technology Co., Ltd
|
|
Product web page: https://www.soyal.com.tw | https://www.soyal.com
|
|
Affected version: 9.0.1 190322
|
|
8.0.6 181227
|
|
|
|
Summary: 701 Server is the program used to set up and configure LAN
|
|
and IP based access control systems, from the COM port used to the
|
|
quantity and type of controllers connected. It is also used for
|
|
programming some of the more complex controllers such as the AR-716E
|
|
and the AR-829E.
|
|
|
|
Desc: The application suffers from an elevation of privileges vulnerability
|
|
which can be used by a simple authenticated user that can change the
|
|
executable file with a binary of choice. The vulnerability exist due
|
|
to the improper permissions, with the 'F' flag (Full) for 'Everyone'
|
|
and 'Authenticated Users' group.
|
|
|
|
Tested on: Microsoft Windows 10 Enterprise
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2021-5633
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5633.php
|
|
|
|
|
|
25.01.2021
|
|
|
|
--
|
|
|
|
|
|
C:\Program Files (x86)\701Server>cacls McuServer.exe
|
|
C:\Program Files (x86)\701Server\McuServer.exe Everyone:F
|
|
NT AUTHORITY\Authenticated Users:(ID)F
|
|
NT AUTHORITY\SYSTEM:(ID)F
|
|
BUILTIN\Administrators:(ID)F
|
|
BUILTIN\Users:(ID)R
|
|
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
|
|
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R
|
|
|
|
C:\Program Files (x86)\701Server> |