yes, you need admin to overwrite the files in those locations to exploit them, but it's still bad ('mkay) to ship unsigned executables