TotalAV 5.15.69 – Unquoted Service Path

• Exploit Database
• 174 阅读

• 作者： Andrea Intilangelo
  日期： 2021-09-22
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/50314/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61

  # Exploit Title: TotalAV 5.15.69 - Unquoted Service Path # Date: 22/09/2021 # Exploit Author: Andrea Intilangelo # Vendor Homepage: https://www.totalav.com # Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe # Version: 5.15.69 # Tested on: Windows 10 Pro 20H2 and 21H1 x64   The PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service services from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a user to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible to place executable(s) following the path of the unquoted string.   Affected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:   PC Security Management Service SecurityService C:\Program Files (x86)\TotalAV\SecurityService.exe Auto PC Security Management Monitoring Service SecurityServiceMonitor C:\Program Files (x86)\TotalAV\SecurityService.exe --monitor Auto Anti-Malware SDK Protected Service AMSProtectedService C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe Auto   C:\Users\user>sc qc SecurityService [SC] QueryServiceConfig OPERAZIONI RIUSCITE   NOME_SERVIZIO: SecurityService TIPO : 10WIN32_OWN_PROCESS TIPO_AVVIO : 2 AUTO_START CONTROLLO_ERRORE : 1 NORMAL NOME_PERCORSO_BINARIO : C:\Program Files(x86)\TotalAV\SecurityService.exe GRUPPO_ORDINE_CARICAMENTO : TAG : 0 NOME_VISUALIZZATO : PC Security Management Service DIPENDENZE : SERVICE_START_NAME : LocalSystem   C:\Users\user>sc qc SecurityServiceMonitor [SC] QueryServiceConfig OPERAZIONI RIUSCITE   NOME_SERVIZIO: SecurityServiceMonitor TIPO : 10WIN32_OWN_PROCESS TIPO_AVVIO : 2 AUTO_START CONTROLLO_ERRORE : 1 NORMAL NOME_PERCORSO_BINARIO : C:\Program Files(x86)\TotalAV\SecurityService.exe --monitor GRUPPO_ORDINE_CARICAMENTO : TAG : 0 NOME_VISUALIZZATO : PC Security Management Monitoring Service DIPENDENZE : SERVICE_START_NAME : LocalSystem   C:\Users\user>sc qc AMSProtectedService [SC] QueryServiceConfig OPERAZIONI RIUSCITE   NOME_SERVIZIO: AMSProtectedService TIPO : 10WIN32_OWN_PROCESS TIPO_AVVIO : 2 AUTO_START CONTROLLO_ERRORE : 1 NORMAL NOME_PERCORSO_BINARIO : C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe GRUPPO_ORDINE_CARICAMENTO : TAG : 0 NOME_VISUALIZZATO : Anti-Malware SDK Protected Service DIPENDENZE : SERVICE_START_NAME : LocalSystem