aa67db6cea
15 changes to exploits/shellcodes/ghdb MinIO < 2024-01-31T20-20-33Z - Privilege Escalation PrusaSlicer 2.6.1 - Arbitrary code execution GUnet OpenEclass E-learning platform 3.15 - 'certbadge.php' Unrestricted File Upload HTMLy Version v2.9.6 - Stored XSS Moodle 3.10.1 - Authenticated Blind Time-Based SQL Injection - _sort_ parameter PopojiCMS Version 2.0.1 - Remote Command Execution Quick CMS v6.7 en 2023 - 'password' SQLi Service Provider Management System v1.0 - SQL Injection WBCE 1.6.0 - Unauthenticated SQL injection WBCE CMS Version 1.6.1 - Remote Command Execution (Authenticated) Wordpress Plugin Playlist for Youtube 1.32 - Stored Cross-Site Scripting (XSS) Wordpress Plugin WP Video Playlist 1.1.1 - Stored Cross-Site Scripting (XSS) Ray OS v2.6.3 - Command Injection RCE(Unauthorized) Terratec dmx_6fire USB - Unquoted Service Path
36 lines
No EOL
1.2 KiB
Text
36 lines
No EOL
1.2 KiB
Text
# Exploit Title: Terratec dmx_6fire USB - Unquoted Service Path
|
|
# Google Dork: null
|
|
# Date: 4/10/2024
|
|
# Exploit Author: Joseph Kwabena Fiagbor
|
|
# Vendor Homepage: https://dmx-6fire-24-96-controlpanel.software.informer.com/download/
|
|
# Software Link:
|
|
# Version: v.1.23.0.02
|
|
# Tested on: windows 7-11
|
|
# CVE : CVE-2024-31804
|
|
|
|
1. Description:
|
|
|
|
The Terratec dmx_6fire usb installs as a service with an unquoted service
|
|
path running
|
|
with SYSTEM privileges.
|
|
This could potentially allow an authorized but non-privileged local
|
|
user to execute arbitrary code with elevated privileges on the system.
|
|
|
|
2. Proof
|
|
|
|
> C:\Users\Astra>sc qc "ttdmx6firesvc"
|
|
> {SC] QueryServiceConfig SUCCESS
|
|
>
|
|
> SERVICE_NAME: ttdmx6firesvc
|
|
> TYPE : 10 WIN32_OWN_PROCESS
|
|
> START_TYPE : 2 AUTO_START
|
|
> ERROR_CONTROL : 1 NORMAL
|
|
> BINARY_PATH_NAME : C:\Program Files\TerraTec\DMX6FireUSB\ttdmx6firesvc.exe -service
|
|
> LOAD_ORDER_GROUP : PlugPlay
|
|
> TAG : 0
|
|
> DISPLAY_NAME : DMX6Fire Control
|
|
> DEPENDENCIES : eventlog
|
|
> : PlugPlay
|
|
> SERVICE_START_NAME : LocalSystem
|
|
>
|
|
> |