Steam (Multiple .exe's) Local Privilage Escalation

By:
 MrDoug
 mrdoug13[at]gmail[dot]com

Version Info:
 Steam windows client
 Built: Jun 30 2009, at 13:29:32
 Steam API: v008
 Steam Package versions: 54/894

Greetz:
 Slappywag, Doomchip, Bolo, Eliwood, and the rest.

Special Thanks:
 Jeremy Brown and Nine:Situations:Group...
 Their work led me to this.

==================================================

The latest Steam client, (and other Steam related executables)
suffer the same privilage escelation issue we saw in Adobe Acrobat NOS
the other day (http://milw0rm.com/exploits/9199).  This is particularly
bad becuase, by default, Steam starts atomaticly.  That means that as
soon as an administrator logs in... game over.

==================================================

POC:

C:\>cacls "C:\Program Files\Steam\Steam.exe"
C:\Program Files\Steam\Steam.exe BUILTIN\Users:F  <-- (Danger Will Robinson!!)
                                 BUILTIN\Power Users:C
                                 BUILTIN\Administrators:F
                                 NT AUTHORITY\SYSTEM:F

The executables listed below are also vulnerable, as well as many, MANY
more that I have not mentioned.  See for yourself.

%programfiles%\Steam\uninstall_css.exe
%programfiles%\Steam\Unwise32.exe
%programfiles%\Steam\GameOverlayUI.exe
%programfiles%\Steam\uninstall_steam.exe
%programfiles%\Steam\WriteMiniDump.exe
%programfiles%\Steam\bin\SteamService.exe

--The following are dependant on what games are installed.

%programfiles%\Steam\common\audiosurf\Audiosurf.exe
%programfiles%\Steam\common\audiosurf\testapp.exe
%programfiles%\Steam\common\audiosurf\engine\QuestViewer.exe
%programfiles%\Steam\common\left 4 dead\left4dead.exe
%programfiles%\Steam\steamapps\[username]\counter-strike source\hl2.exe
%programfiles%\Steam\steamapps\[username]\half-life 2\hl2.exe
%programfiles%\Steam\steamapps\[username]\garrysmod\hl2.exe

...etc...etc...etc...

There are probably 100 more, just look around.  I am yet to see an
executable in the Steam directory with propor permissions.

==================================================

Exploit:

So simple... write it yourself you silly goose :3