To access the dashboard, Schedule scans, API and Search become a patron

Search for hundreds of thousands of exploits

"CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path"

Author

Exploit author

"Luis Martínez"

Platform

Exploit platform

windows

Release date

Exploit published date

2020-08-06

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# Exploit Title: CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2020-08-05
# Vendor Homepage: https://www.wibu.com/us/products/codemeter/runtime.html
# Tested Version: 6.60
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "CodeMeter" | findstr /i /v """

CodeMeter Runtime Server                                  CodeMeter.exe                                  C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe                                                                                                                                                                                                                           Auto

# Service info:

C:\>sc qc CodeMeter.exe
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: CodeMeter.exe
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START  (DELAYED)
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : CodeMeter Runtime Server
        DEPENDENCIES       : Tcpip
                           : Winmgmt
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Release Date Title Type Platform Author
2020-11-20 "Free MP3 CD Ripper 2.8 - Multiple File Buffer Overflow (Metasploit)" local windows ZwX
2020-11-20 "Zortam Mp3 Media Studio 27.60 - Remote Code Execution (SEH)" local windows "Vincent Wolterman"
2020-11-20 "Boxoft Convert Master 1.3.0 - 'wav' SEH Local Exploit" local windows stresser
2020-11-20 "WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-11-20 "IBM Tivoli Storage Manager Command Line Administrative Interface 5.2.0.1 - id' Field Stack Based Buffer Overflow" local windows "Paolo Stagno"
2020-11-19 "Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow (PoC)" dos windows "Vincent Wolterman"
2020-11-19 "M/Monit 3.7.4 - Privilege Escalation" webapps multiple "Dolev Farhi"
2020-11-19 "Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure" remote hardware "Nitesh Surana"
2020-11-19 "PESCMS TEAM 2.3.2 - Multiple Reflected XSS" webapps multiple icekam
2020-11-19 "M/Monit 3.7.4 - Password Disclosure" webapps multiple "Dolev Farhi"
Release Date Title Type Platform Author
2020-08-06 "CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path" local windows "Luis Martínez"
2020-08-05 "QlikView 12.50.20000.0 - 'FTP Server Address' Denial of Service (PoC)" dos windows "Luis Martínez"
2020-08-04 "RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC)" dos windows "Luis Martínez"
2020-08-04 "Mocha Telnet Lite for iOS 4.2 - 'User' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-11-25 "Waves MaxxAudio Drivers 1.1.6.0 - 'WavesSysSvc64' Unquoted Service Path" local windows "Luis Martínez"
2019-11-19 "Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path" local windows "Luis Martínez"
2019-11-19 "scadaApp for iOS 1.1.4.0 - 'Servername' Denial of Service (PoC)" dos ios "Luis Martínez"
2019-11-18 "Emerson PAC Machine Edition 9.70 Build 8595 - 'FxControlRuntime' Unquoted Service Path" local windows "Luis Martínez"
2019-11-18 "Open Proficy HMI-SCADA 5.0.0.25920 - 'Password' Denial of Service (PoC)" dos ios "Luis Martínez"
2019-11-04 "OpenVPN Connect 3.0.0.272 - 'agent_ovpnconnect' Unquoted Service Path" local windows "Luis Martínez"
2019-01-31 "Advanced Host Monitor 11.90 Beta - 'Registration number' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-07 "BlueAuditor 1.7.2.0 - 'Key' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-07 "SpotFTP Password Recover 2.4.2 - 'Name' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-07 "Foscam Video Management System 1.1.4.9 - 'Username' Denial of Service (PoC)" dos windows "Luis Martínez"
2019-01-02 "NBMonitor Network Bandwidth Monitor 1.6.5.0 - 'Name' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2019-01-02 "NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2018-09-13 "InduSoft Web Studio 8.1 SP1 - 'Tag Name' Buffer Overflow (SEH)" local windows_x86-64 "Luis Martínez"
2018-09-11 "InTouch Machine Edition 8.1 SP1 - 'Nombre del Tag' Buffer Overflow (SEH)" local windows_x86-64 "Luis Martínez"
2018-09-04 "iSmartViewPro 1.5 - 'DDNS' Buffer Overflow" local windows_x86 "Luis Martínez"
2018-09-03 "Symantec Mobile Encryption for iPhone 2.1.0 - 'Server' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-09-03 "Trend Micro Virtual Mobile Infrastructure 5.5.1336 - 'Server address' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-08-29 "Cisco AnyConnect Secure Mobility Client 4.6.01099 - 'Introducir URL' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-08-28 "Cisco Network Assistant 6.3.3 - 'Cisco Login' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-08-27 "Trend Micro Enterprise Mobile Security 2.0.0.1700 - 'Servidor' Denial of Service (PoC)" dos ios "Luis Martínez"
2018-08-24 "SkypeApp 12.8.487.0 - 'Cuenta de Skype o Microsoft' Denial of Service (PoC)" dos windows_x86-64 "Luis Martínez"
2018-08-02 "AgataSoft Auto PingMaster 1.5 - 'Host name' Denial of Service (PoC)" local windows "Luis Martínez"
2018-07-31 "Switch Port Mapping Tool 2.81 - 'SNMP Community Name' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-07-30 "ipPulse 1.92 - 'IP Address/HostName-Comment' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-07-27 "NetScanTools Basic Edition 2.5 - 'Hostname' Denial of Service (PoC)" dos windows "Luis Martínez"
2018-07-27 "QNap QVR Client 5.1.1.30070 - 'Password' Denial of Service (PoC)" dos windows "Luis Martínez"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48735/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.