# Exploit Title: TotalAV - Unquoted Service Path
# Date: 2021-09-22
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.totalav.com
# Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe
# Version: 5.15.69
# Tested on: Windows 10 Pro 20H2 and 21H1 x64
# CVE: CVE-2021-35313

The PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service
services from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a
user to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible
to place executable(s) following the path of the unquoted string.

Affected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:

PC Security Management Service       SecurityService   C:\Program Files (x86)\TotalAV\SecurityService.exe       Auto
PC Security Management Monitoring Service   SecurityServiceMonitor  C:\Program Files (x86)\TotalAV\SecurityService.exe --monitor     Auto
Anti-Malware SDK Protected Service    AMSProtectedService   C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe   Auto

C:\Users\user>sc qc SecurityService
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: SecurityService
    TIPO         : 10  WIN32_OWN_PROCESS
    TIPO_AVVIO       : 2   AUTO_START
    CONTROLLO_ERRORE     : 1   NORMAL
    NOME_PERCORSO_BINARIO    : C:\Program Files(x86)\TotalAV\SecurityService.exe
    GRUPPO_ORDINE_CARICAMENTO :
    TAG         : 0
    NOME_VISUALIZZATO     : PC Security Management Service
    DIPENDENZE      :
    SERVICE_START_NAME : LocalSystem

C:\Users\user>sc qc SecurityServiceMonitor
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: SecurityServiceMonitor
    TIPO         : 10  WIN32_OWN_PROCESS
    TIPO_AVVIO       : 2   AUTO_START
    CONTROLLO_ERRORE    : 1   NORMAL
    NOME_PERCORSO_BINARIO     : C:\Program Files(x86)\TotalAV\SecurityService.exe --monitor
    GRUPPO_ORDINE_CARICAMENTO :
    TAG         : 0
    NOME_VISUALIZZATO     : PC Security Management Monitoring Service
    DIPENDENZE       :
    SERVICE_START_NAME : LocalSystem

C:\Users\user>sc qc AMSProtectedService
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: AMSProtectedService
    TIPO         : 10  WIN32_OWN_PROCESS
    TIPO_AVVIO       : 2   AUTO_START
    CONTROLLO_ERRORE    : 1   NORMAL
    NOME_PERCORSO_BINARIO     : C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe
    GRUPPO_ORDINE_CARICAMENTO :
    TAG         : 0
    NOME_VISUALIZZATO     : Anti-Malware SDK Protected Service
    DIPENDENZE       :
    SERVICE_START_NAME : LocalSystem