Spy Emergency 25.0.650 – ‘Multiple’ Unquoted Service Path

# Exploit Title: Spy Emergency 25.0.650 -  Unquoted Service Path
# Discovery by: Erick Galindo 
# Discovery Date: 2021-06-11
# Vendor Homepage: https://www.spy-emergency.com/
# Software Link: https://www.spy-emergency.com/download/download.php?id=1
# Tested Version: 25.0.650.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro  x64 es
# Step to discover Unquoted Service Path:

C:>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "SpyEmrg"| findstr /i /v """
Spy Emergency Health Check           SpyEmrgHealth        C:\Program Files\NETGATE\Spy Emergency\SpyEmergencyHealth.exe          Auto
Spy Emergency Engine Service           SpyEmrgSrv       C:\Program Files\NETGATE\Spy Emergency\SpyEmergencySrv.exe      Auto

# Service info
C:>sc qc "SpyEmrgHealth"
SC QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SpyEmrgHealth
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\NETGATE\Spy Emergency\SpyEmergencyHealth.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Spy Emergency Health Check
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

# Service info

C:\>sc qc "SpyEmrgSrv"
SC QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SpyEmrgSrv
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\NETGATE\Spy Emergency\SpyEmergencySrv.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Spy Emergency Engine Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem

#Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.