SOYAL 701 Server 9.0.1 – Insecure Permissions

• Exploit Database
• 112 阅读

• 作者： LiquidWorm
  日期： 2021-03-19
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/49678/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49

  # Exploit Title: SOYAL 701 Server 9.0.1 - Insecure Permissions # Date: 25.01.2021 # Exploit Author: LiquidWorm # Vendor Homepage: https://www.soyal.com.tw https://www.soyal.com   Vendor: SOYAL Technology Co., Ltd Product web page: https://www.soyal.com.tw | https://www.soyal.com Affected version: 9.0.1 190322 8.0.6 181227   Summary: 701 Server is the program used to set up and configure LAN and IP based access control systems, from the COM port used to the quantity and type of controllers connected. It is also used for programming some of the more complex controllers such as the AR-716E and the AR-829E.   Desc: The application suffers from an elevation of privileges vulnerability which can be used by a simple authenticated user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the 'F' flag (Full) for 'Everyone' and 'Authenticated Users' group.   Tested on: Microsoft Windows 10 Enterprise     Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience     Advisory ID: ZSL-2021-5633 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5633.php     25.01.2021   --     C:\Program Files (x86)\701Server>cacls McuServer.exe C:\Program Files (x86)\701Server\McuServer.exe Everyone:F NT AUTHORITY\Authenticated Users:(ID)F NT AUTHORITY\SYSTEM:(ID)F BUILTIN\Administrators:(ID)F BUILTIN\Users:(ID)R APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R   C:\Program Files (x86)\701Server>