Exploit-DB #39845
Description: Operation Technology ETAP 14.1.0 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-05-23
Author: LiquidWorm

Exploit:

Operation Technology ETAP 14.1.0 Local Privilege Escalation


Vendor: Operation Technology, Inc.
Product web page: http://www.etap.com
Affected version: 14.1.0.0

Summary: Enterprise Software Solution for Electrical Power Systems. ETAP
is the most comprehensive electrical engineering software platform for the
design, simulation, operation, and automation of generation, transmission,
distribution, and industrial systems. As a fully integrated model-driven
enterprise solution, ETAP extends from modeling to operation to offer a
Real-Time Power Management System.

Desc: ETAP suffers from an elevation of privileges vulnerability which can
be used by a simple authenticated user that can change the executable file
with a binary of choice. The vulnerability exist due to the improper permissions,
with the 'C' flag (Change) for 'Authenticated Users' group.

Tested on: Microsfot Windows 7 Professional SP1 (EN) x86_64
           Microsoft Windows 7 Ultimate SP1 (EN) x86_64


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5323
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5323.php


07.04.2016

--


C:\>icacls "ETAP 1410"
ETAP 1410 BUILTIN\Administrators:(I)(F)
          BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
          NT AUTHORITY\SYSTEM:(I)(F)
          NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
          BUILTIN\Users:(I)(OI)(CI)(RX)
          NT AUTHORITY\Authenticated Users:(I)(M)
          NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)


C:\ETAP 1410>icacls etaps64.exe
etaps64.exe BUILTIN\Administrators:(I)(F)
            NT AUTHORITY\SYSTEM:(I)(F)
            BUILTIN\Users:(I)(RX)
            NT AUTHORITY\Authenticated Users:(I)(M)

Successfully processed 1 files; Failed processing 0 files


Affected binaries:
------------------

C:\ETAP 1410>dir
 Volume in drive C is Windows
 Volume Serial Number is 56F3-8688

 Directory of C:\ETAP 1410

07/04/2016  11:42    <DIR>          .
07/04/2016  11:42    <DIR>          ..
01/02/2016  11:14               766 16COLOR.CUR
19/01/2016  02:36           238,592 acsdvd.exe
19/01/2016  02:34            81,920 bifact.dll
19/01/2016  02:36         7,980,032 ca.exe
26/02/2016  16:56         1,220,608 cddll64.dll
19/01/2016  01:48            14,848 ComtradeReader.dll
17/11/2015  17:54            66,982 configdescriptions.xml
01/02/2016  11:14             1,620 ContourSetting.ini
07/04/2016  11:41    <DIR>          Convert
19/01/2016  02:35           212,992 csdvd.exe
01/02/2016  11:14            27,136 ctl3d32.dll
19/01/2016  02:28           112,128 ctrlpb.exe
27/06/2013  15:17             7,582 Currency.xml
05/03/2009  12:44            65,536 dao.dll
07/04/2016  11:41    <DIR>          Datablocks
26/02/2016  16:35        13,256,192 DATADB.dll
26/02/2016  16:51        19,252,736 datadb64.dll
10/08/2015  13:00         2,011,136 DBCompareInstr.mdb
10/08/2015  13:01           151,552 dbcompareinstr.sdf
08/10/2010  13:20           503,808 DBCompareOutput.mdb
05/11/2014  14:45            86,016 DBCompareOutput.sdf
08/10/2010  13:20           503,808 DBCompareSummary.mdb
05/11/2014  14:45            28,672 DBCompareSummary.sdf
19/01/2016  02:31            53,248 DBExtractConsoleApp.exe
19/01/2016  02:35           896,000 dccalc.exe
26/02/2016  16:54           352,256 dcspdt64.dll
26/02/2016  16:55           348,160 dcspst64.dll
01/02/2016  11:14           229,376 defaultA.mdb
01/02/2016  11:14        20,971,520 defaulte.mdb
01/02/2016  11:14        17,657,856 defaultm.mdb
01/02/2016  11:14           143,360 dunzip32.dll
01/02/2016  11:14           176,128 dzip32.dll
01/02/2016  11:14             3,262 e-dpp2.ico
01/02/2016  11:14           260,942 Electronic License Grant Terms.pdf
01/02/2016  11:14           315,392 enable40.dll
09/02/2016  17:38           137,728 enginemsgs.dll
19/01/2016  02:34           147,456 enginemsgs64.dll
19/01/2016  02:31           253,952 et2waydataxexcel.exe
19/01/2016  02:31           135,168 etaccess.exe
26/02/2016  16:52         3,872,768 ETAnalyzers64.dll
01/02/2016  11:14            76,999 etap.ico
25/03/2001  10:56           246,434 etap2csv.exe
19/01/2016  02:31            54,784 etapcim.dll
19/01/2016  02:31         1,174,528 EtapDevices.DLL
19/01/2016  02:31            67,072 EtapGISDevices.dll
19/01/2016  02:31            14,336 ETAPMongoDB.dll
26/02/2016  16:24         1,325,568 Etapmsgs.dll
26/02/2016  16:38         1,335,296 etapmsgs64.dll
05/02/2016  17:04        49,012,284 etaps.chm
07/04/2016  11:45               660 ETAPS.INI
09/12/2003  12:13                88 etaps.pek
26/02/2016  17:23        86,749,184 etaps64.exe
22/06/2011  17:40             6,130 ETAPS64.exe.config
26/02/2016  16:29        23,688,704 etapsdb.dll
26/02/2016  16:45        26,805,248 etapsdb64.dll
19/01/2016  02:31           125,440 EtapSmartPlant.exe
26/06/2015  12:51        24,571,904 etapsqlenglishmodel.bak
26/06/2015  12:52        24,436,736 etapsqlmetricmodel.bak
19/01/2016  02:31            52,736 ETAP_CIM.EXE
01/02/2016  11:14             6,184 etap_dy_.ttf
19/01/2016  02:31            94,208 etap_edpp.exe
19/01/2016  02:31            20,480 ETAP_GlobalUtilities.dll
19/01/2016  02:31            32,768 ETAP_Graphics.dll
24/06/2015  08:40         9,977,953 etap_overview.pdf
26/02/2016  16:27            44,032 EtArcFlash.dll
26/02/2016  16:44            51,712 EtArcFlash64.dll
19/01/2016  02:31           192,512 etarcgis.exe
19/01/2016  02:31           192,512 etarcgis92.exe
19/01/2016  02:31           192,512 etarcgis93.exe
19/01/2016  02:31           427,520 ETArcGIS_TD.exe
19/01/2016  02:31           428,544 ETArcGIS_TD10.exe
26/02/2016  16:54           417,792 etbatt64.dll
26/02/2016  16:52           614,912 ETBranch64.dll
26/02/2016  16:26         1,353,728 etcabp.exe
26/02/2016  16:53         4,139,008 etcb6