Winstep 18.06.0096 Xtreme Service Unquoted Service Path

2020.11.13

Credit: SamAlucard

Risk: Medium

Local: Yes

Remote: No

CVE: N/A

CWE: N/A

#Exploit Title: Winstep 18.06.0096 - 'Xtreme Service' Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2020-11-08
#Vendor : Winstep
#Version : WsxService 18.06.0096
#Vendor Homepage :  https://www.winstep.net/xtreme.asp
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============

C:\>sc qc "Winstep Xtreme Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Winstep Xtreme Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Winstep\WsxService
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Winstep Xtreme Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Winstep 18.06.0096 Xtreme Service Unquoted Service Path

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.