Prey 1.9.6 "cronservice" unquoted service path Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2020-10-28 |
Type : local |
Platform : windows
This exploit / vulnerability Prey 1.9.6 "cronservice" unquoted service path is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: Prey 1.9.6 - "CronService" Unquoted Service Path
# Discovery by: Ömer Tuygun
# Discovery Date:16.10.2020
# Vendor Homepage: https://preyproject.com/
# Software Link: https://preyproject.com/download/
# Tested Version: 1.9.6
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es
# Description:
A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other
security applications
where it could potentially be executed during application startup or
reboot. If successful, the local user's code would execute with the
elevated privileges
of the application.