Authored by Mohammed Alshehri

WinAVR version 20100110 suffers from an insecure folder permissions vulnerability.

# Exploit Title: WinAVR Version 20100110 - Insecure Folder Permissions
# Date: 2020-12-11
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://sourceforge.net/projects/winavr/
# Software Link: https://sourceforge.net/projects/winavr/files/WinAVR/20100110/WinAVR-20100110-install.exe
# Version: Version 20100110
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763

# Info:

PS C:WinAVR-20100110bin> icacls.exe .
. BUILTINAdministrators:(I)(OI)(CI)(F)
NT AUTHORITYSYSTEM:(I)(OI)(CI)(F)
BUILTINUsers:(I)(OI)(CI)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)
NT AUTHORITYAuthenticated Users:(I)(OI)(CI)(IO)(M)

Successfully processed 1 files; Failed processing 0 files
PS C:WinAVR-20100110bin> icacls.exe *.dll
cygwin1.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

itcl32.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

itk32.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

libusb0.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

tcl84.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

tclpip84.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

tk84.dll BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

Successfully processed 7 files; Failed processing 0 files
PS C:WinAVR-20100110bin> icacls.exe *.exe
avarice.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-addr2line.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-ar.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-as.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-c++.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-c++filt.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-cpp.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-g++.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-gcc-4.3.3.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-gcc.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-gcov.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-gdb.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-gprof.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-insight.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-ld.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-nm.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-objcopy.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-objdump.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-ranlib.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-readelf.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-size.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-strings.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr-strip.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-addr2line.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-ar.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-as.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-c++.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-c++filt.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-cpp.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-g++.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-gcc-4.3.2.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-gcc.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-gcov.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-gdb.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-gprof.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-insight.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-ld.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-nm.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-objcopy.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-objdump.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-ranlib.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-readelf.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-size.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-strings.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avr32-strip.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

avrdude.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

loaddrv.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

simulavr.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

splint.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

srec_cat.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

srec_cmp.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

srec_info.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

tclsh84.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

wish84.exe BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
NT AUTHORITYAuthenticated Users:(I)(M)

Successfully processed 54 files; Failed processing 0 files
PS C:WinAVR-20100110bin>

# Exploit:
This vulnerability could permit executing code with the escalated privileges by hijacking one of the DLLs or *.exe files.