TCQ Unquoted Service Path

TCQ suffers from an unquoted service path vulnerability related to ITeCProteccioAppServer.exe.


SHA-256 | ece06efa8e457d7e848a6bfc1601ab3b47f8109f9668dd3ecb621adf2cdb2e77

Download
# Exploit Title: TCQ - 'ITeCProteccioAppServer.exe'  Unquoted Service Path
# Discovery by: Edgar Carrillo Egea - https://twitter.com/ecarrilloeg
# Discovery Date: 2022-04-25
# Vendor Homepage: https://itec.es/programas/
# Vulnerability Type: Unquoted Service Path Privilege Escalation
# Tested on OS: Microsoft Windows 11 Home

To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
                            

C:\Users\edgar>sc qc "ITeCProteccioAppServer"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: ITeCProteccioAppServer
        TIPO               : 110  WIN32_OWN_PROCESS (interactive)
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\ITeC\LIC\ITeCProteccioAppServer.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : ITeCProteccioAppServer
        DEPENDENCIAS       : RPCSS
        NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\edgar>systeminfo

Nombre de host:                            DESKTOP-0DL5SID
Nombre del sistema operativo:              Microsoft Windows 11 Home
Versión del sistema operativo:             10.0.22000 N/D Compilación 22000


Source: packetstormsecurity.com
Related Posts