Genexus Protection Server 9.6.4.2 Unquoted Service Path

Genexus Protection Server version 9.6.4.2 suffers from an unquoted service path vulnerability.


MD5 | a6bb6f4ddc540796eb47b5ed81d68eee

Download
#Exploit Title: Genexus Protection Server 9.6.4.2 - 'protsrvservice' Unquoted Service Path
Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2020-11-08
#Vendor : Genexus
#Version : Genexus Protection Server 9.6.4.2
#Software Link: https://www.genexus.com/en/developers/downloadcenter?data=;;
#Vendor Homepage :  https://www.genexus.com/es/
#Tested on OS: Windows 10 Pro

#Analyze PoC :
==============

C:\>sc qc protsrvservice
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: protsrvservice
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Common
Files\Artech\GXProt1\ProtSrv.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : ProtSrvService
        DEPENDENCIAS       : RPCSS
        NOMBRE_INICIO_SERVICIO: LocalSystem


Source: packetstormsecurity.com
Related Posts