WinAVR version 20100110 suffers from an insecure folder permissions vulnerability.
# Exploit Title: WinAVR Version 20100110 - Insecure Folder Permissions
# Date: 2020-12-11
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://sourceforge.net/projects/winavr/
# Software Link: https://sourceforge.net/projects/winavr/files/WinAVR/20100110/WinAVR-20100110-install.exe
# Version: Version 20100110
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763
# Info:
PS C:WinAVR-20100110bin> icacls.exe .
. BUILTINAdministrators:(I)(OI)(CI)(F)
NT AUTHORITYSYSTEM:(I)(OI)(CI)(F)
BUILTINUsers:(I)(OI)(CI)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
NT AUTHORITYAuthenticated Users:(I)(OI)(CI)(IO)(M)
Successfully processed 1 files; Failed processing 0 files
PS C:WinAVR-20100110bin> icacls.exe *.dll
cygwin1.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
itcl32.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
itk32.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
libusb0.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
tcl84.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
tclpip84.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
tk84.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
Successfully processed 7 files; Failed processing 0 files
PS C:WinAVR-20100110bin> icacls.exe *.exe
avarice.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-addr2line.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-ar.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-as.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-c++.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-c++filt.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-cpp.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-g++.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-gcc-4.3.3.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-gcc.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-gcov.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-gdb.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-gprof.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-insight.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-ld.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-nm.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-objcopy.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-objdump.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-ranlib.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-readelf.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-size.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-strings.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr-strip.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-addr2line.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-ar.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-as.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-c++.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-c++filt.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-cpp.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-g++.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-gcc-4.3.2.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-gcc.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-gcov.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-gdb.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-gprof.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-insight.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-ld.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-nm.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-objcopy.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-objdump.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-ranlib.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-readelf.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-size.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-strings.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avr32-strip.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
avrdude.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
loaddrv.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
simulavr.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
splint.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
srec_cat.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
srec_cmp.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
srec_info.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
tclsh84.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
wish84.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
Successfully processed 54 files; Failed processing 0 files
PS C:WinAVR-20100110bin>
# Exploit:
This vulnerability could permit executing code with the escalated privileges by hijacking one of the DLLs or *.exe files.