Ubisoft Uplay 4.6 – Insecure File Permissions Privilege Escalation

Exploit Database
112 阅读

作者： LiquidWorm

日期： 2014-07-03
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/33961/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

Ubisoft Uplay 4.6 Insecure File Permissions Local Privilege Escalation

Vendor: Ubisoft Entertainment S.A.

Product web page: http://www.ubi.com

Affected version: 4.6.3208 (PC)

4.5.2.3010 (PC)

Summary: Uplay is a digital distribution, digital rights management,

multiplayer and communications service created by Ubisoft to provide

an experience similar to the achievements/trophies offered by various

other game companies.

- Uplay PC is a desktop client which replaces individual game launchers

previously used for Ubisoft games. With Uplay PC, you have all your Uplay

enabled games and Uplay services in the same place and you get access to

a whole new set of features for your PC games.

Desc: Uplay for PC suffers from an elevation of privileges vulnerability

which can be used by a simple user that can change the executable file

with a binary of choice. The vulnerability exist due to the improper

permissions, with the 'F' flag (Full) for 'Everyone' group, making the

entire directory 'Ubisoft Game Launcher' and its files and sub-dirs

world-writable.

Tested on: Microsoft Windows 7 Professional SP1 (EN)

Microsoft Windows 7 Ultimate SP1 (EN)

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

@zeroscience

Advisory ID: ZSL-2014-5191

Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5191.php

Vendor: http://forums.ubi.com/forumdisplay.php/513-Uplay

30.05.2014

=======================================================================

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>icacls *.exe |findstr Everyone

UbisoftGameLauncher.exe Everyone:(I)(F)

UbisoftGameLauncher64.exe Everyone:(I)(F)

Uninstall.exe Everyone:(I)(F)

Uplay.exe Everyone:(I)(F)

UplayCrashReporter.exe Everyone:(I)(F)

UplayService.exe Everyone:(I)(F)

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>

=======================================================================

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>icacls Uplay.exe

Uplay.exe Everyone:(I)(F)

NT AUTHORITY\SYSTEM:(I)(F)

BUILTIN\Administrators:(I)(F)

BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>

=======================================================================

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>icacls *.exe |findstr (F)

UbisoftGameLauncher.exe Everyone:(I)(F)

NT AUTHORITY\SYSTEM:(I)(F)

BUILTIN\Administrators:(I)(F)

UbisoftGameLauncher64.exe Everyone:(I)(F)

NT AUTHORITY\SYSTEM:(I)(F)

BUILTIN\Administrators:(I)(F)

Uninstall.exe Everyone:(I)(F)

NT AUTHORITY\SYSTEM:(I)(F)

BUILTIN\Administrators:(I)(F)

Uplay.exe Everyone:(I)(F)

NT AUTHORITY\SYSTEM:(I)(F)

BUILTIN\Administrators:(I)(F)

UplayCrashReporter.exe Everyone:(I)(F)

NT AUTHORITY\SYSTEM:(I)(F)

BUILTIN\Administrators:(I)(F)

UplayService.exe Everyone:(I)(F)

NT AUTHORITY\SYSTEM:(I)(F)

BUILTIN\Administrators:(I)(F)

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>

=======================================================================

C:\Program Files (x86)\Ubisoft>icacls "Ubisoft Game Launcher"

Ubisoft Game Launcher Everyone:(OI)(CI)(F)

NT SERVICE\TrustedInstaller:(I)(F)

NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)

NT AUTHORITY\SYSTEM:(I)(F)

NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)

BUILTIN\Administrators:(I)(F)

BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)

BUILTIN\Users:(I)(RX)

BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)

CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Program Files (x86)\Ubisoft>

=======================================================================

Changed permissions (vendor fix):

---------------------------------

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>cacls Uplay.exe

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe BUILTIN\Users:(ID)(special access:)

DELETE

READ_CONTROL

WRITE_DAC

WRITE_OWNER

STANDARD_RIGHTS_REQUIRED

FILE_READ_DATA

FILE_WRITE_DATA

FILE_APPEND_DATA

FILE_READ_EA

FILE_WRITE_EA

FILE_EXECUTE

NT AUTHORITY\SYSTEM:(ID)F

BUILTIN\Administrators:(ID)F

BUILTIN\Users:(ID)R

labpc\user4dmin:(ID)F

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>

=======================================================================