Macro Expert 4.9 - Unquoted Service Path Vulnerability

# Exploit Title: Macro Expert 4.9 - Unquoted Service Path
# Exploit Author: Murat DEMIRCI
# Vendor Homepage: http://www.macro-expert.com/
# Software Link: http://www.macro-expert.com/product/gm_setup_4.9.exe
# Version: 4.9
# Tested on: Windows 10
 
# Proof of Concept :
 
C:\Users\Murat>sc qc "Macro Expert"
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: Macro Expert
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : c:\program files (x86)\grasssoft\macro expert\MacroService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Macro Expert
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
 
# If a malicious payload insert into related path and service is executed in anyway, this can gain new privilege access to the system and perform malicious acts.
 
#  0day.today [2023-06-16]  #