WinSaber - Unquoted Service Path Privilege Escalation Vulnerability

Technical Details & Description:
================================
The application suffers from an unquoted search path issue impacting the trojan 'winSaber'. This could potentially allow 
an authorized but non-privileged local user to execute arbitrary code with system privileges on the system.


Proof of Concept (PoC):
=======================
The issue can be exploited by local attackers with restricted system user account or network access and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


--- Privileges Logs ---
C:Program FilesWinSaber>sc qc WinSaber
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: WinSaber
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:Program FilesWinSaberWinSaber.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : winsaber
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


Domain:     www.zwx.fr
Contact:    [email protected]	
Social:     twitter.com/XSSed.fr
Feeds:      www.zwx.fr/feed/
Advisory:   www.vulnerability-lab.com/show.php?user=ZwX
            packetstormsecurity.com/files/author/12026/
            cxsecurity.com/search/author/DESC/AND/FIND/0/10/ZwX/
            0day.today/author/27461

#  0day.today [2018-04-03]  #