To access the dashboard, Schedule scans, API and Search become a patron

Search for hundreds of thousands of exploits

"Exploit - EPSON 1.124 - 'seksmdb.exe' Unquoted Service Path"

Author

Exploit author

"İsmail Önder Kaya"

Platform

Exploit platform

windows

Release date

Exploit published date

2020-10-28

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# Exploit Title: EPSON 1.124 - 'seksmdb.exe' Unquoted Service Path
# Discovery by: İsmail Önder Kaya
# Discovery Date: 2020-10-27
# Vendor Homepage: https://www.epson.co.uk/support?productID=10820&os=22#drivers_and_manuals
# Tested Version: 1.124
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64

# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "EPSON_P2B" | findstr /i /v """

SEcnStatutsDatabase        SENADB       C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmdb.exe           Auto

# Service info:
 
C:\>sc qc SENADB
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SENADB
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmdb.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : SEcnStatutsDatabase
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
 

#Exploit:
 
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Release Date Title Type Platform Author
2020-11-20 "Free MP3 CD Ripper 2.8 - Multiple File Buffer Overflow (Metasploit)" local windows ZwX
2020-11-20 "Zortam Mp3 Media Studio 27.60 - Remote Code Execution (SEH)" local windows "Vincent Wolterman"
2020-11-20 "Boxoft Convert Master 1.3.0 - 'wav' SEH Local Exploit" local windows stresser
2020-11-20 "WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-11-20 "IBM Tivoli Storage Manager Command Line Administrative Interface 5.2.0.1 - id' Field Stack Based Buffer Overflow" local windows "Paolo Stagno"
2020-11-19 "Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow (PoC)" dos windows "Vincent Wolterman"
2020-11-19 "M/Monit 3.7.4 - Privilege Escalation" webapps multiple "Dolev Farhi"
2020-11-19 "Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure" remote hardware "Nitesh Surana"
2020-11-19 "PESCMS TEAM 2.3.2 - Multiple Reflected XSS" webapps multiple icekam
2020-11-19 "M/Monit 3.7.4 - Password Disclosure" webapps multiple "Dolev Farhi"
Release Date Title Type Platform Author
2020-10-28 "Exploit - EPSON 1.124 - 'seksmdb.exe' Unquoted Service Path" local windows "İsmail Önder Kaya"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48965/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.