Steam Local Privilege Escalation

`Steam (Multiple .exe's) Local Privilage Escalation  
  
By:  
MrDoug  
mrdoug13[at]gmail[dot]com  
  
Version Info:  
Steam windows client  
Built: Jun 30 2009, at 13:29:32  
Steam API: v008  
Steam Package versions: 54/894  
  
Greetz:  
Slappywag, Doomchip, Bolo, Eliwood, and the rest.  
  
Special Thanks:  
Jeremy Brown and Nine:Situations:Group...  
Their work led me to this.  
  
==================================================  
  
The latest Steam client, (and other Steam related executables)  
suffer the same privilage escelation issue we saw in Adobe Acrobat NOS  
the other day (http://milw0rm.com/exploits/9199). This is particularly  
bad becuase, by default, Steam starts atomaticly. That means that as  
soon as an administrator logs in... game over.  
  
==================================================  
  
POC:  
  
C:\>cacls "C:\Program Files\Steam\Steam.exe"  
C:\Program Files\Steam\Steam.exe BUILTIN\Users:F <-- (Danger Will Robinson!!)  
BUILTIN\Power Users:C  
BUILTIN\Administrators:F  
NT AUTHORITY\SYSTEM:F  
  
The executables listed below are also vulnerable, as well as many, MANY  
more that I have not mentioned. See for yourself.  
  
%programfiles%\Steam\uninstall_css.exe  
%programfiles%\Steam\Unwise32.exe  
%programfiles%\Steam\GameOverlayUI.exe  
%programfiles%\Steam\uninstall_steam.exe  
%programfiles%\Steam\WriteMiniDump.exe  
%programfiles%\Steam\bin\SteamService.exe  
  
--The following are dependant on what games are installed.  
  
%programfiles%\Steam\common\audiosurf\Audiosurf.exe  
%programfiles%\Steam\common\audiosurf\testapp.exe  
%programfiles%\Steam\common\audiosurf\engine\QuestViewer.exe  
%programfiles%\Steam\common\left 4 dead\left4dead.exe  
%programfiles%\Steam\steamapps\[username]\counter-strike source\hl2.exe  
%programfiles%\Steam\steamapps\[username]\half-life 2\hl2.exe  
%programfiles%\Steam\steamapps\[username]\garrysmod\hl2.exe  
  
...etc...etc...etc...  
  
There are probably 100 more, just look around. I am yet to see an  
executable in the Steam directory with propor permissions.  
  
==================================================  
  
Exploit:  
  
So simple... write it yourself you silly goose :3  
  
`