NO-IP DUC 4.1.1 Privilege Escalation
Posted on 18 October 2016
===================================================== # NO-IP DUC v4.1.1 - Unquoted Service Path Privilege Escalation ===================================================== # Vendor Homepage: http://noip.com # Date: 14 Oct 2016 # Software Link : http://www.noip.com/client/DUCSetup_v4_1_1.exe # Version : 4.1.1 # Author: Ashiyane Digital Security Team # Contact: hehsan979@gmail.com ===================================================== # Description: NO-IP DUC v4.1.1 installs as a service with an unquoted service path with name NoIPDUCService4. # PoC: Service name : NoIPDUCService4 C:>sc qc NoIPDUCService4 [SC] QueryServiceConfig SUCCESS SERVICE_NAME: NoIPDUCService4 TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START (DELAYED) ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:Program FilesNo-IPducservice.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : NO-IP DUC v4.1.1 DEPENDENCIES : SERVICE_START_NAME : LocalSystem ===================================================== # Discovered By : Ehsan Hosseini =====================================================
