CVE-2017-20218: Serviio PRO 1.8 未加引号路径权限提升漏洞

#!/usr/bin/env python3 """ CVE-2017-20218 PoC - Serviio PRO Unquoted Service Path Privilege Escalation This PoC demonstrates the vulnerability by checking if Serviio service exists and if the service path is unquoted. """ import subprocess import os import sys def check_serviio_service(): """Check if Serviio service exists and its configuration""" try: # Query Serviio service information result = subprocess.run( ['sc', 'qc', 'Serviio'], capture_output=True, text=True ) if 'BINPATH' in result.stdout: print("[+] Serviio service found!") # Extract binary path for line in result.stdout.split('\n'): if 'BINPATH' in line: path = line.split(':', 1)[1].strip() print(f"[+] Binary path: {path}") # Check if path is quoted if not (path.startswith('"') and path.endswith('"')): print("[!] VULNERABLE: Path is not quoted!") print("[!] Attackers can place malicious executable in path segments") return True else: print("[-] Path is properly quoted") return False else: print("[-] Serviio service not found") return False except Exception as e: print(f"[-] Error checking service: {e}") return False def check_directory_permissions(path): """Check if Users group has excessive permissions""" try: result = subprocess.run( ['icacls', path], capture_output=True, text=True ) if 'Users' in result.stdout and 'Full' in result.stdout: print(f"[!] VULNERABLE: Users group has Full control on {path}") return True return False except Exception as e: print(f"[-] Error checking permissions: {e}") return False def main(): print("=" * 60) print("CVE-2017-20218 - Serviio PRO Unquoted Service Path PoC") print("=" * 60) # Check if running on Windows if sys.platform != 'win32': print("[-] This PoC only works on Windows systems") return print("\n[1] Checking Serviio service configuration...") service_vuln = check_serviio_service() print("\n[2] Checking Serviio directory permissions...") default_path = r'C:\Program Files\Serviio' if os.path.exists(default_path): check_directory_permissions(default_path) else: print(f"[-] Serviio directory not found at {default_path}") print("\n[3] Summary") print("-" * 40) if service_vuln: print("[!] System is VULNERABLE to CVE-2017-20218") print("[!] An attacker with low privileges can:") print(" 1. Place a malicious Program.exe in C:\\") print(" 2. Wait for service restart or system reboot") print(" 3. Gain SYSTEM level code execution") else: print("[-] System appears to be patched") if __name__ == '__main__': main()