SOYAL 701 Server 9.0.1 – Insecure Permissions

• Exploit Database
• 19 阅读

• 作者： LiquidWorm
  日期： 2021-03-19
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/49678/

• # Exploit Title: SOYAL 701 Server 9.0.1 - Insecure Permissions
  # Date: 25.01.2021
  # Exploit Author: LiquidWorm
  # Vendor Homepage: https://www.soyal.com.tw https://www.soyal.com
  
  Vendor: SOYAL Technology Co., Ltd
  Product web page: https://www.soyal.com.tw | https://www.soyal.com
  Affected version: 9.0.1 190322
  8.0.6 181227
  
  Summary: 701 Server is the program used to set up and configure LAN
  and IP based access control systems, from the COM port used to the
  quantity and type of controllers connected. It is also used for
  programming some of the more complex controllers such as the AR-716E
  and the AR-829E.
  
  Desc: The application suffers from an elevation of privileges vulnerability
  which can be used by a simple authenticated user that can change the
  executable file with a binary of choice. The vulnerability exist due
  to the improper permissions, with the 'F' flag (Full) for 'Everyone'
  and 'Authenticated Users' group.
  
  Tested on: Microsoft Windows 10 Enterprise
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2021-5633
  Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5633.php
  
  
  25.01.2021
  
  --
  
  
  C:\Program Files (x86)\701Server>cacls McuServer.exe
  C:\Program Files (x86)\701Server\McuServer.exe Everyone:F
   NT AUTHORITY\Authenticated Users:(ID)F
   NT AUTHORITY\SYSTEM:(ID)F
   BUILTIN\Administrators:(ID)F
   BUILTIN\Users:(ID)R
   APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
   APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R
  
  C:\Program Files (x86)\701Server>