TeraCopyService 3.1 Unquoted Service Path Privilege Escalation

2017.09.05

Credit: Rithwik Jayasimha

Risk: Medium

Local: Yes

Remote: No

CVE: N/A

CWE: CWE-264

# Exploit Title: TeraCopyService 3.1 - Unquoted Service Path Privilege Escalation
# Date of Discovery: August 31 2017
# Exploit Author: Rithwik Jayasimha
# Author Homepage/Contact: https://thel3l.me
# Vendor Name: Codesector
# Vendor Homepage: http://www.codesector.com/
# Software Link: TOVA 8.2-202 - http://www.codesector.com/teracopy
# Affected Versions: <3.1 confirmed, possibly later versions
# Tested on: Windows 7
# Category: local
# Vulnerability type: Local Privilege Escalation


# Description:
    Teracopy installs a service ("TeraCopyService") with an unquoted service path running with SYSTEM
    privileges.
    This allows any non-privileged local user to execute arbitrary code with SYSTEM privileges.
# Proof Of Concept:
    C:\Users\potato> sc qc TeraCopyService
    [SC] QueryServiceConfig SUCCESS
    SERVICE_NAME: TeraCopyService
            TYPE               : 10  WIN32_OWN_PROCESS
            START_TYPE         : 2   AUTO_START
            ERROR_CONTROL      : 0   IGNORE
            BINARY_PATH_NAME   : C:\Program Files\TeraCopy\TeraCopyService.exe
            LOAD_ORDER_GROUP   : System Reserved
            TAG                : 0
            DISPLAY_NAME       : TeraCopy Service
            DEPENDENCIES       :
            SERVICE_START_NAME : LocalSystem

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

TeraCopyService 3.1 Unquoted Service Path Privilege Escalation

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.