Multiple Icecream Apps Local Privilege Escalation

vendor:

Icecream Ebook Reader, Icecream Screen Recorder, Icecream Slideshow Maker

by:

Tulpa

7.5

CVSS

HIGH

Local Privilege Escalation

CWE

Product Name: Icecream Ebook Reader, Icecream Screen Recorder, Icecream Slideshow Maker

Affected Version From: Icecream Ebook Reader 4.21, Icecream Screen Recorder 4.21, Icecream Screen Recorder 2.12

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows 10 Professional x64, Windows XP SP3 x86

2016

Multiple Icecream Apps Local Privilege Escalation

The default installation directory for Icecream Ebook Reader, Icecream Screen Recorder, and Icecream Slideshow Maker have weak folder permissions that grant EVERYONE change/modify privileges. This allows an attacker to execute their own code under any other user running the application.

Mitigation:

Apply proper folder permissions to the installation directories of Icecream Ebook Reader, Icecream Screen Recorder, and Icecream Slideshow Maker.

Source

Exploit-DB raw data:

# Exploit Title: Multiple Icecream Apps Local Privilege Escalation
# Date: 13/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: icecreamapps.com
# Software Versions Affected: Icecream Ebook Reader 4.21 | Icecream Screen Recorder 4.21 | Icecream Screen Recorder 2.12
# Software Link: http://icecreamapps.com/Ebook-Reader/ | http://icecreamapps.com/Screen-Recorder/ | http://icecreamapps.com/Slideshow-Maker/
# Tested on: Windows 10 Professional x64 and Windows XP SP3 x86


1. Description:

The default installation directory for Icecream Ebook Reader is "C:\Program Files (x86)\Icecream Ebook Reader" with weak folder permissions that grants EVERYONE change/modify

privileges to the contents of the directory and it's subfolders. This allows an attacker opportunity for their own code execution under any other user running the

application. The same vulnerability exists for "Icecream Screen Recorder" as well as "Icecream Slideshow Maker".

2. Proof

C:\Program Files (x86)>icacls "Icecream Ebook Reader"
Icecream Ebook Reader Everyone:(OI)(CI)(M)
                      NT SERVICE\TrustedInstaller:(I)(F)
                      NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                      NT AUTHORITY\SYSTEM:(I)(F)
                      NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                      BUILTIN\Administrators:(I)(F)
                      BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                      BUILTIN\Users:(I)(RX)
                      BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                      CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)

C:\Program Files (x86)>icacls "Icecream Screen Recorder"
Icecream Screen Recorder Everyone:(OI)(CI)(M)
                         NT SERVICE\TrustedInstaller:(I)(F)
                         NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                         NT AUTHORITY\SYSTEM:(I)(F)
                         NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                         BUILTIN\Administrators:(I)(F)
                         BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                         BUILTIN\Users:(I)(RX)
                         BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                         CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                         APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                         APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)

C:\Program Files\Icecream Slideshow Maker Everyone:(OI)(CI)C
                                          BUILTIN\Users:R
                                          BUILTIN\Users:(OI)(CI)(IO)(special access:)
                                                                    GENERIC_READ
                                                                    GENERIC_EXECUTE
                                          BUILTIN\Power Users:C
                                          BUILTIN\Power Users:(OI)(CI)(IO)C
                                          BUILTIN\Administrators:F
                                          BUILTIN\Administrators:(OI)(CI)(IO)F
                                          NT AUTHORITY\SYSTEM:F
                                          NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
                                          TULPA-842269BBB\Administrator:F
                                          CREATOR OWNER:(OI)(CI)(IO)F



3. Exploit:

Simply replace any of the application exe's or any of the dll's with your preferred payload and wait for execution.