CVE-2020-36938 WinAVR不安全的文件夹权限漏洞

#!/usr/bin/env python3 """ CVE-2020-36938 PoC - WinAVR Insecure Permissions This PoC demonstrates checking for insecure file permissions in WinAVR installation. """ import os import sys import subprocess import ctypes from pathlib import Path def check_admin_privileges(): """Check if running with administrator privileges""" try: is_admin = ctypes.windll.shell32.IsUserAnAdmin() return is_admin != 0 except: return False def find_winavr_installation(): """Try to locate WinAVR installation directory""" possible_paths = [ r"C:\WinAVR-20100110", r"C:\Program Files\WinAVR", r"C:\Program Files (x86)\WinAVR", os.path.expanduser("~\\WinAVR"), ] for path in possible_paths: if os.path.exists(path): return path return None def check_file_permissions(file_path): """ Check if a file has insecure permissions allowing modification by non-admin users. Uses Windows icacls command to check permissions. """ try: # Get current ACLs for the file result = subprocess.run( ['icacls', file_path], capture_output=True, text=True, timeout=10 ) # Check if 'Everyone' or 'Users' group has write/modify permissions output = result.stdout.lower() # Look for problematic permissions insecure_indicators = ['(F)', '(M)', '(W)', '(D)'] for indicator in insecure_indicators: if 'everyone' in output and indicator in output: return True, f"Everyone has {indicator} permission" if 'users' in output and indicator in output: return True, f"Users group has {indicator} permission" return False, "Permissions appear secure" except Exception as e: return None, f"Error checking permissions: {e}" def scan_winavr_directory(winavr_path): """Scan WinAVR directory for files with insecure permissions""" vulnerable_files = [] print(f"[*] Scanning WinAVR directory: {winavr_path}") # Target file extensions commonly exploited target_extensions = ['.exe', '.dll', '.bin', '.a', '.o'] for root, dirs, files in os.walk(winavr_path): for filename in files: if any(filename.lower().endswith(ext) for ext in target_extensions): file_path = os.path.join(root, filename) is_vulnerable, details = check_file_permissions(file_path) if is_vulnerable: print(f"[!] VULNERABLE: {file_path}") print(f" Details: {details}") vulnerable_files.append({ 'path': file_path, 'details': details }) return vulnerable_files def main(): print("=" * 60) print("CVE-2020-36938 PoC - WinAVR Insecure Folder Permissions") print("=" * 60) if not check_admin_privileges(): print("[*] Note: Running as non-admin user") print("[*] This PoC will check if you can modify WinAVR files") else: print("[!] Warning: Running with admin privileges") print("[*] Results may not reflect actual vulnerability") winavr_path = find_winavr_installation() if not winavr_path: print("[-] WinAVR installation not found") print("[-] Please install WinAVR or update search paths") return print(f"[+] Found WinAVR at: {winavr_path}") vulnerable_files = scan_winavr_directory(winavr_path) print("\n" + "=" * 60) print(f"[*] Scan complete. Found {len(vulnerable_files)} vulnerable files.") if vulnerable_files: print("[!] System is VULNERABLE to CVE-2020-36938") print("[!] An attacker with low privileges can modify executable files") print("[!] This can lead to privilege escalation or remote code execution") else: print("[+] No obvious vulnerabilities found") print("=" * 60) if __name__ == "__main__": main()