CVE-2021-47945 Argus DVR未引用服务路径漏洞

import os import win32service import win32con # Proof of Concept: Check for Unquoted Service Path # This script simulates checking the DVRWatchdog service def check_unquoted_service_path(service_name): try: # In a real scenario, this would query the registry # hkey = win32service.OpenSCManager(None, None, win32service.SC_MANAGER_CONNECT) # service = win32service.OpenService(hkey, service_name, win32service.SERVICE_QUERY_CONFIG) # config = win32service.QueryServiceConfig(service) # Simulated vulnerable path image_path = "C:\\Program Files\\Argus\\DVRWatchdog.exe" if not image_path.startswith('"') and " " in image_path: print(f"[+] Vulnerable Service Found: {service_name}") print(f"[+] Unquoted Path: {image_path}") # Check for write access in the path segments parts = image_path.split('\\') current_path = "" for part in parts[:-1]: current_path += part + "\\" # Check if directory is writable (simplified logic) if os.path.exists(current_path): print(f"[*] Checking write access for: {current_path}") # If writable, an attacker could drop 'Program.exe' here else: print("[-] Service path is quoted or contains no spaces.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": check_unquoted_service_path("DVRWatchdog")