WinSaber - Unquoted Service Path Privilege Escalation Vulnerability

2016-10-05T00:00:00
ID 1337DAY-ID-25360
Type zdt
Reporter ZwX
Modified 2016-10-05T00:00:00

Description

Product & Service Introduction:

WinSaber.exe is an executable files developed by Innovative Knowledge for the Windows Operating System. This virus can infect, replace, or corrupt existing EXE files, which can then lead to error messages. Such file and its related exe files gets into the computer system hiding behind the programs which user downloads. (Copy of the Homepage: http://www.mypccaresolutions.com/2016/07/14/get-rid-of-ads-bywinsaber-exe-virus/)

                                        
                                            Technical Details & Description:
================================
The application suffers from an unquoted search path issue impacting the trojan 'winSaber'. This could potentially allow 
an authorized but non-privileged local user to execute arbitrary code with system privileges on the system.


Proof of Concept (PoC):
=======================
The issue can be exploited by local attackers with restricted system user account or network access and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


--- Privileges Logs ---
C:Program FilesWinSaber>sc qc WinSaber
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: WinSaber
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:Program FilesWinSaberWinSaber.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : winsaber
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


Domain:     www.zwx.fr
Contact:    [email protected]	
Social:     twitter.com/XSSed.fr
Feeds:      www.zwx.fr/feed/
Advisory:   www.vulnerability-lab.com/show.php?user=ZwX
            packetstormsecurity.com/files/author/12026/
            cxsecurity.com/search/author/DESC/AND/FIND/0/10/ZwX/
            0day.today/author/27461

#  0day.today [2018-04-03]  #