Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863557259

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Multiple Icecream Apps Local Privilege Escalation
# Date: 13/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: icecreamapps.com
# Software Versions Affected: Icecream Ebook Reader 4.21 | Icecream Screen Recorder 4.21 | Icecream Screen Recorder 2.12
# Software Link: http://icecreamapps.com/Ebook-Reader/ | http://icecreamapps.com/Screen-Recorder/ | http://icecreamapps.com/Slideshow-Maker/
# Tested on: Windows 10 Professional x64 and Windows XP SP3 x86


1. Description:

The default installation directory for Icecream Ebook Reader is "C:\Program Files (x86)\Icecream Ebook Reader" with weak folder permissions that grants EVERYONE change/modify

privileges to the contents of the directory and it's subfolders. This allows an attacker opportunity for their own code execution under any other user running the

application. The same vulnerability exists for "Icecream Screen Recorder" as well as "Icecream Slideshow Maker".

2. Proof

C:\Program Files (x86)>icacls "Icecream Ebook Reader"
Icecream Ebook Reader Everyone:(OI)(CI)(M)
                      NT SERVICE\TrustedInstaller:(I)(F)
                      NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                      NT AUTHORITY\SYSTEM:(I)(F)
                      NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                      BUILTIN\Administrators:(I)(F)
                      BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                      BUILTIN\Users:(I)(RX)
                      BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                      CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)

C:\Program Files (x86)>icacls "Icecream Screen Recorder"
Icecream Screen Recorder Everyone:(OI)(CI)(M)
                         NT SERVICE\TrustedInstaller:(I)(F)
                         NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                         NT AUTHORITY\SYSTEM:(I)(F)
                         NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                         BUILTIN\Administrators:(I)(F)
                         BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                         BUILTIN\Users:(I)(RX)
                         BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                         CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                         APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                         APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)

C:\Program Files\Icecream Slideshow Maker Everyone:(OI)(CI)C
                                          BUILTIN\Users:R
                                          BUILTIN\Users:(OI)(CI)(IO)(special access:)
                                                                    GENERIC_READ
                                                                    GENERIC_EXECUTE
                                          BUILTIN\Power Users:C
                                          BUILTIN\Power Users:(OI)(CI)(IO)C
                                          BUILTIN\Administrators:F
                                          BUILTIN\Administrators:(OI)(CI)(IO)F
                                          NT AUTHORITY\SYSTEM:F
                                          NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
                                          TULPA-842269BBB\Administrator:F
                                          CREATOR OWNER:(OI)(CI)(IO)F



3. Exploit:

Simply replace any of the application exe's or any of the dll's with your preferred payload and wait for execution.