CVE-2020-36980: SAntivirus IC 未加引号服务路径权限提升漏洞

#!/usr/bin/env python3 """ CVE-2020-36980 PoC - SAntivirus IC Unquoted Service Path Checks if the SAntivirus IC service has an unquoted path vulnerability. Note: This is for educational and authorized testing purposes only. """ import subprocess import sys import os def check_unquoted_service_path(service_name): """ Check if a Windows service has an unquoted executable path. Returns True if vulnerable (unquoted path with spaces), False otherwise. """ try: result = subprocess.run( ['sc', 'qc', service_name], capture_output=True, text=True ) output = result.stdout # Look for BINARY_PATH_NAME in the output for line in output.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f"Service path: {path}") # Check if path contains spaces and is not quoted has_spaces = any(space in path for space in ['Program Files', 'Program Files (x86)', 'Documents and Settings']) is_quoted = path.startswith('"') or path.startswith("'") if has_spaces and not is_quoted: print(f"[!] VULNERABLE: Path contains spaces but is not quoted!") print(f"[*] An attacker could place a malicious executable in an intermediate directory") return True else: print(f"[+] NOT VULNERABLE: Path is properly quoted or has no spaces") return False print(f"[-] Service '{service_name}' not found or no path information available") return False except Exception as e: print(f"[-] Error checking service: {e}") return False def main(): # Target service name for SAntivirus IC service_name = "SantivirusIC" # Common service name, may vary print("=" * 60) print("CVE-2020-36980 - SAntivirus IC Unquoted Service Path Check") print("=" * 60) # Check the service is_vulnerable = check_unquoted_service_path(service_name) print("\n" + "=" * 60) if is_vulnerable: print("RESULT: Target is VULNERABLE to CVE-2020-36980") print("An attacker with local access can escalate privileges to SYSTEM") else: print("RESULT: Target appears NOT vulnerable") print("=" * 60) return 0 if not is_vulnerable else 1 if __name__ == "__main__": sys.exit(main())