EasyPHP Devserver 16.1.1 - Insecure File Permissions Privilege Escalation

Author: Ashiyane Digital Security Team
type: local
platform: windows
port: 
date_added: 2016-12-11  
date_updated: 2016-12-11  
verified: 1  
codes:   
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comEasyPHP-Devserver-16.1.1-setup.exe  

raw file: 40902.txt  

Title: EasyPHP Devserver Insecure File Permissions Privilege Escalation
Application: EasyPHP Devserver
Versions Affected: 16.1
Vendor URL: http://www.easyphp.org/
Discovered by: Ashiyane Digital Security Team ~ Micle
Tested on: Windows 10 Professional x86
Bugs: Insecure File Permissions Privilege Escalation
Source: http://www.micle.ir/exploits/1003
Date: 10-Dec-2016

Description:
EasyPHP installs by default to "C:\Program Files\EasyPHP-Devserver-16.1"
with very weak file permissions granting any
user full permission to the exe. This allows opportunity for code
execution against any other user running the application.

Proof:
C:\Program Files\EasyPHP-Devserver-16.1>cacls run-easyphp-devserver.exe
C:\Program Files\EasyPHP-Devserver-16.1\run-easyphp-devserver.exe
BUILTIN\Users:(ID)C
NT AUTHORITY\SYSTEM:(ID)F
                                   BUILTIN\Administrators:(ID)F
                                   APPLICATION PACKAGE AUTHORITY\ALL
APPLICATION PACKAGES:(ID)R

Exploit:
Simply replace run-easyphp-devserver.exe and wait for execution.