Motorola Device Manager 2.5.4 – ‘MotoHelperService.exe’ Unquoted Service Path

• Exploit Database
• 34 阅读

• 作者： Angel Canseco
  日期： 2020-11-09
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/49012/

• # Exploit Title: Motorola Device Manager 2.5.4 - 'MotoHelperService.exe' Unquoted Service Path
  # Discovery by: Angel Canseco
  # Discovery Date: 2020-11-07
  # Vendor Homepage: https://motorola-device-manager.programas-gratis.net/descarga-completada
  # Tested Version: 2.5.4
  # Vulnerability Type: Unquoted Service Path
  # Tested on OS: Windows 10 Pro x64 es
  
  # Step to discover Unquoted Service Path:
  
  C:\>wmic service get name, pathname, displayname, startmode | findstr /i
  "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "MotoHelperService " |
  findstr /i /v """
  
  Motorola Device Manager Service
  
  Motorola Device ManagerC:\Program Files (x86)\Motorola Mobility\Motorola
  Device Manager\MotoHelperService.exe
  Auto
  
  
  # Service info:
  
  C:\>sc qc "Motorola Device Manager"
  [SC] QueryServiceConfig CORRECTO
  
  NOMBRE_SERVICIO: Motorola Device Manager
  TIPO : 10WIN32_OWN_PROCESS
  TIPO_INICIO: 2 AUTO_START
  CONTROL_ERROR: 1 NORMAL
  NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Motorola
  Mobility\Motorola Device Manager\MotoHelperService.exe
  GRUPO_ORDEN_CARGA:
  ETIQUETA : 0
  NOMBRE_MOSTRAR : Motorola Device Manager Service
  DEPENDENCIAS :
  NOMBRE_INICIO_SERVICIO: LocalSystem
  
  #Exploit:
  
  A successful attempt would cause the local user to be able to insert their
  code in the system root path
  undetected by the OS or other security applications and elevate his
  privileges after reboot.