关键漏洞信息 漏洞详情 EDB-ID: 49371 CVE: N/A Author: Mayur Parmar Type: LOCAL Platform: WINDOWS Date: 2021-01-06 Vulnerable App: IObit Uninstaller 10 Pro Exploit Title: IObit Uninstaller 10 Pro - Unquoted Service Path Vendor Homepage: https://www.iobit.com Software Link: https://www.iobit.com/en/advanceduninstaller.php Version: 10 Tested on: Windows 10 漏洞描述 Unquoted Service Path: 当服务的可执行路径包含空格且未用引号括起时，会导致称为 Unquoted Service Path 的漏洞，允许用户获取 SYSTEM 权限（仅当易受攻击的服务以 SYSTEM 权限运行时）。 在 Windows 中，如果服务路径未用引号括起且包含空格，Windows 会将空格视为分隔符，从而将剩余的路径作为参数传递。 示例路径: C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe 缓解措施 确保包含空格的任何服务路径用引号括起。 参考链接 https://www.rapid7.com/db/modules/exploit/windows/local/unquoted_service_path/ https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae https://www.hackingarticles.in/windows-privilege-escalation-unquoted-path-service/ https://sec-consult.com/blog/detail/windows-privilege-escalation-an-approach-for-penetration-testers/