Search for hundreds of thousands of exploits

"CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path"

Author

Exploit author

"Luis Martínez"

Platform

Exploit platform

windows

Release date

Exploit published date

2020-08-06

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# Exploit Title: CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2020-08-05
# Vendor Homepage: https://www.wibu.com/us/products/codemeter/runtime.html
# Tested Version: 6.60
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "CodeMeter" | findstr /i /v """

CodeMeter Runtime Server                                  CodeMeter.exe                                  C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe                                                                                                                                                                                                                           Auto

# Service info:

C:\>sc qc CodeMeter.exe
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: CodeMeter.exe
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START  (DELAYED)
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : CodeMeter Runtime Server
        DEPENDENCIES       : Tcpip
                           : Winmgmt
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Release DateTitleTypePlatformAuthor
2020-08-06"CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path"localwindows"Luis Martínez"
2020-08-05"QlikView 12.50.20000.0 - 'FTP Server Address' Denial of Service (PoC)"doswindows"Luis Martínez"
2020-08-04"RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC)"doswindows"Luis Martínez"
2020-08-04"Mocha Telnet Lite for iOS 4.2 - 'User' Denial of Service (PoC)"doswindows"Luis Martínez"
2019-11-25"Waves MaxxAudio Drivers 1.1.6.0 - 'WavesSysSvc64' Unquoted Service Path"localwindows"Luis Martínez"
2019-11-19"scadaApp for iOS 1.1.4.0 - 'Servername' Denial of Service (PoC)"dosios"Luis Martínez"
2019-11-19"Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path"localwindows"Luis Martínez"
2019-11-18"Emerson PAC Machine Edition 9.70 Build 8595 - 'FxControlRuntime' Unquoted Service Path"localwindows"Luis Martínez"
2019-11-18"Open Proficy HMI-SCADA 5.0.0.25920 - 'Password' Denial of Service (PoC)"dosios"Luis Martínez"
2019-11-04"OpenVPN Connect 3.0.0.272 - 'agent_ovpnconnect' Unquoted Service Path"localwindows"Luis Martínez"
2019-01-31"Advanced Host Monitor 11.90 Beta - 'Registration number' Denial of Service (PoC)"doswindows"Luis Martínez"
2019-01-07"BlueAuditor 1.7.2.0 - 'Key' Denial of Service (PoC)"doswindows"Luis Martínez"
2019-01-07"SpotFTP Password Recover 2.4.2 - 'Name' Denial of Service (PoC)"doswindows"Luis Martínez"
2019-01-07"Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC)"doswindows"Luis Martínez"
2019-01-02"NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)"doswindows_x86-64"Luis Martínez"
2019-01-02"NBMonitor Network Bandwidth Monitor 1.6.5.0 - 'Name' Denial of Service (PoC)"doswindows_x86-64"Luis Martínez"
2018-09-13"InduSoft Web Studio 8.1 SP1 - 'Tag Name' Buffer Overflow (SEH)"localwindows_x86-64"Luis Martínez"
2018-09-11"InTouch Machine Edition 8.1 SP1 - 'Nombre del Tag' Buffer Overflow (SEH)"localwindows_x86-64"Luis Martínez"
2018-09-04"iSmartViewPro 1.5 - 'DDNS' Buffer Overflow"localwindows_x86"Luis Martínez"
2018-09-03"Symantec Mobile Encryption for iPhone 2.1.0 - 'Server' Denial of Service (PoC)"dosios"Luis Martínez"
2018-09-03"Trend Micro Virtual Mobile Infrastructure 5.5.1336 - 'Server address' Denial of Service (PoC)"dosios"Luis Martínez"
2018-08-29"Cisco AnyConnect Secure Mobility Client 4.6.01099 - 'Introducir URL' Denial of Service (PoC)"dosios"Luis Martínez"
2018-08-28"Cisco Network Assistant 6.3.3 - 'Cisco Login' Denial of Service (PoC)"doswindows"Luis Martínez"
2018-08-27"Trend Micro Enterprise Mobile Security 2.0.0.1700 - 'Servidor' Denial of Service (PoC)"dosios"Luis Martínez"
2018-08-24"SkypeApp 12.8.487.0 - 'Cuenta de Skype o Microsoft' Denial of Service (PoC)"doswindows_x86-64"Luis Martínez"
2018-08-02"AgataSoft Auto PingMaster 1.5 - 'Host name' Denial of Service (PoC)"localwindows"Luis Martínez"
2018-07-31"Switch Port Mapping Tool 2.81 - 'SNMP Community Name' Denial of Service (PoC)"doswindows"Luis Martínez"
2018-07-30"ipPulse 1.92 - 'IP Address/HostName-Comment' Denial of Service (PoC)"doswindows"Luis Martínez"
2018-07-27"NetScanTools Basic Edition 2.5 - 'Hostname' Denial of Service (PoC)"doswindows"Luis Martínez"
2018-07-27"QNap QVR Client 5.1.1.30070 - 'Password' Denial of Service (PoC)"doswindows"Luis Martínez"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48735/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.